CVE-2026-45367Disclosure

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.7, the FHIRPathEngine implementation passes user-controlled regular expressions from matches(), matchesFull(), and replaceMatches() to Java regex operations without effective timeouts, allowing catastrophic backtracking and denial of service. This issue is fixed in version 6.9.7.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-1333

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

1 mentions across 1 observed day

What's happening

Technical details provided in 1 signal
Disclosure: 1 classified signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Disclosure

1100.0%

Referenced assets1 URL

By indicator

https://dailycve.com/hapi-fhir-redos-cve-2026-45367-high/

Full discourse1 post

DailyCVE@dailycve142d
Disclosure
🔴 HAPI FHIR, ReDoS, #CVE-2026-45367 (High) https://dailycve.com/hapi-fhir-redos-cve-2026-45367-high/
Post summary
The post announces a high‑severity ReDoS vulnerability in HAPI FHIR, identified as CVE‑2026‑45367, without providing evidence of PoC, exploitable code, patches, or active attacks.
0000051
206 followersView on X

Explore more

Back to dashboard