Hapifhir Hl7 Fhir Core
7 CVEs affecting Hapifhir Hl7 Fhir Core. Latest disclosed: 2026-07-08. Critical: 2, High: 4.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-34361 | Critical | 9.3 | 2026-03-31 | HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.4, the FHIR Validator HTTP servic… |
CVE-2026-55471 | Critical | 9.1 | 2026-07-08 | HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.10, org.hl7.fhir.utilities.XsltUtilities… |
CVE-2023-24057 | High | 8.1 | 2023-01-26 | HL7 (Health Level 7) FHIR Core Libraries before 5.6.92 allow attackers to extract files into arbitrary directories via directory traversal from a crafted ZIP o… |
CVE-2026-55470 | High | 7.5 | 2026-07-08 | HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.10, the fix for CVE-2026-45367 incomplete… |
CVE-2023-28465 | High | 7.5 | 2023-12-12 | The package-decompression feature in HL7 (Health Level 7) FHIR Core Libraries before 5.6.106 allows attackers to copy arbitrary files to certain directories vi… |
CVE-2026-34359 | High | 7.4 | 2026-03-31 | HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.4, ManagedWebAccessUtils.getServe… |
CVE-2026-34360 | Medium | 5.8 | 2026-03-31 | HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.4, the /loadIG HTTP endpoint in t… |