Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.9 and 6.9.4.2, all implementations of FHIRPathEngine accept arbitrary FHIRPath expressions and evaluate them without input validation, and the FHIRPath functions matches(), matchesFull(), and replaceMatches() pass user-controlled regular expressions to Java's Pattern.compile() and String.replaceAll() through an incomplete timeout utility. An attacker can send a resource containing an evil regex pattern that causes catastrophic backtracking, exhausting CPU resources and causing denial of service in the FHIR Validator HTTP endpoint and affected org.hl7.fhir.* modules. This issue is fixed in versions 6.9.9 and 6.9.4.2.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-07-17 | 2 | Disclosure1Patch1 |
| 2026-07-18 | 1 | Disclosure1 |
CVE-2026-49485 Denial of Service via Regular Expression Catastrophic Backtracking in HAPI FHIR https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-49485
Post summary
The entry announces CVE-2026-49485, a DoS vulnerability in HAPI FHIR caused by regex catastrophic backtracking, with no PoC, exploit, or patch information provided.
🚨*CVE* CVE-2026-49485 HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.9 and 6.9.4.2, all implementations of FHIRPathEn… https://www.cve.org/CVERecord?id=CVE-2026-49485 ----- Traducción: CVE-2026-49485 HAP… http://infoflow.cloud`
Post summary
The post announces CVE-2026-49485, a vulnerability in HAPI FHIR affecting versions prior to 6.9.9 and 6.9.4.2, but provides no exploitation or patch information.
CVE-2026-49485 HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.9 and 6.9.4.2, all implementations of FHIRPathEn… https://www.cve.org/CVERecord?id=CVE-2026-49485
Post summary
CVE-2026-49485 impacts HAPI FHIR versions before 6.9.9 and 6.9.4.2; users should upgrade to affected versions to remediate the issue.