CVE-2026-55471

Name of the Vulnerable Software and Affected Versions org.hl7.fhir.utilities versions 6.9.8 and earlier

Description The org.hl7.fhir.utilities library contains an XML External Entity (XXE) injection flaw. The saxonTransform() function overloads instantiate a bare net.sf.saxon.TransformerFactoryImpl without restricting external access. This allows an attacker who controls the transformed XML, its embedded DTD, or the referenced stylesheet to trigger the resolution of external general entities and external DTD/parameter entities. This can lead to local file disclosure, where files readable by the JVM process are exfiltrated, and blind XXE or Server-Side Request Forgery (SSRF), enabling internal network probing and access to cloud metadata from the host's network position.

Recommendations Update org.hl7.fhir.utilities to a version later than 6.9.8. As a temporary workaround, avoid using the saxonTransform() function overloads when processing XML from untrusted or attacker-influenced sources.