CVE-2026-49485

Name of the Vulnerable Software and Affected Versions HAPI FHIR versions prior to 6.9.9 HAPI FHIR versions prior to 6.9.4.2

Description Implementations of FHIRPathEngine evaluate arbitrary FHIRPath expressions without proper input validation. The functions matches(), matchesFull(), and replaceMatches() pass user-controlled regular expressions to Java's Pattern.compile() and String.replaceAll() using an incomplete timeout utility. This utility fails to stop the execution thread once a timeout occurs. Additionally, certain method calls within FHIRPathEngine are not protected by this utility. An attacker can exploit this by providing a specially crafted regular expression that triggers catastrophic backtracking—a condition where the regex engine takes exponential time to process a string—leading to CPU exhaustion and denial of service in the FHIR Validator HTTP endpoint and affected org.hl7.fhir.* modules.

Recommendations Update to version 6.9.9. Update to version 6.9.4.2.