By vendor

Hapifhir vulnerabilities

Known CVEs affecting Hapifhir products, prioritized by severity, with SEC.co remediation and detection guidance.

1 published vulnerability

• CVE-2026-55470HIGH 7.5

  HAPI FHIR, a widely-used Java library for healthcare data exchange, contains a regular expression denial-of-service (ReDoS) vulnerability in its DSTU2 module. An unauthenticated attacker can send specially crafted input to the FHIRPathEngine.matches() function, causing the server to enter catastrophic regex backtracking and consume CPU resources until the service becomes unresponsive. This is a regression—a prior patch for a related vulnerability (CVE-2026-45367) fixed the same issue in one function but missed it in another, leaving the attack surface open.