CVE-2026-55470

Name of the Vulnerable Software and Affected Versions org.hl7.fhir.dstu2 (affected versions not specified)

Description An incomplete patch in the org.hl7.fhir.dstu2 module allows an unauthenticated attacker to cause a Regular Expression Denial of Service (ReDoS). While other modules were updated to include RegexTimeout protection, the matches() function in the DSTU2 module continues to use the raw String.matches(sw) method without a timeout or complexity check. This allows a specially crafted regular expression to trigger catastrophic backtracking, leading to server CPU exhaustion and service disruption. This issue affects applications evaluating user-supplied FHIRPath expressions, such as FHIR Validator HTTP endpoints and FHIR servers applying FHIRPath invariants.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.