CVE-2026-55470: HAPI FHIR ReDoS Vulnerability in DSTU2 Module – Patch Now

Technical summary

CVE-2026-55470 is a regular expression denial-of-service (ReDoS) vulnerability in HAPI FHIR versions before 6.9.10. The root cause is an incomplete patch to CVE-2026-45367. While the replaceMatches() method in org.hl7.fhir.dstu2/utils/FHIRPathEngine.java was updated to use RegexTimeout protection, the matches() method was overlooked and still calls raw String.matches(sw) without timeout safeguards. An attacker can exploit this by submitting FHIR queries or data with maliciously crafted regular expressions that trigger quadratic backtracking behavior in Java's regex engine. The attack requires no authentication and succeeds on the default configuration (AV:N/PR:N). The impact is purely availability—successful exploitation exhausts CPU and causes denial of service.

Business impact

Healthcare organizations relying on HAPI FHIR for EHR interoperability face service disruption risk. A successful attack leaves the FHIR endpoint unresponsive, degrading patient care workflows that depend on real-time data exchange (e.g., referrals, medication reconciliation, lab result retrieval). Recovery requires manual service restart. The unauthenticated nature and low barrier to entry increase operational risk, particularly for organizations operating FHIR interfaces as public or semi-public APIs. Attackers do not gain data access, but the availability impact can trigger incident response costs and regulatory reporting obligations if availability SLAs are breached.

Affected systems

HAPI FHIR Core versions prior to 6.9.10 are affected, specifically the DSTU2 module (org.hl7.fhir.dstu2). Organizations should inventory deployments of hapifhir:hl7_fhir_core and identify which versions are in use. This includes embedded use in custom FHIR servers, integration platforms, and healthcare data exchange applications built on HAPI FHIR. The vulnerability does not affect organizations using FHIR servers or libraries unrelated to HAPI FHIR.

Exploitability

Exploitability is high. The attack vector is network-based, no authentication is required, and no user interaction is necessary. An attacker with network access to a FHIR endpoint can trigger the vulnerability by submitting a single HTTP request containing a malicious FHIRPath expression or FHIR query parameter that exercises the regex engine. No special privileges, knowledge of system internals, or complex multi-step attack chain is required. Proof-of-concept code would be trivial to construct for anyone familiar with ReDoS principles. However, successful exploitation depends on the FHIR server actually calling the vulnerable matches() function with attacker-controlled input—organizations may reduce risk if their application logic does not expose FHIRPath querying to untrusted users.

Remediation

Upgrade HAPI FHIR Core to version 6.9.10 or later. This version includes the complete fix for CVE-2026-45367, adding RegexTimeout protection to the matches() method in the DSTU2 module. Organizations should test the upgrade in a non-production environment to ensure compatibility with downstream integrations and custom code that depends on HAPI FHIR. Verify against the vendor advisory that your deployment includes the patched DSTU2 module if you use a modular or shaded build of HAPI FHIR.

Patch guidance

Download and deploy HAPI FHIR 6.9.10 or later from the official repository. If you build HAPI FHIR as part of a larger application, ensure your dependency management tool (Maven, Gradle) pulls the updated version and that you rebuild and redeploy your application. If you use a FHIR server distribution that bundles HAPI FHIR, check with the vendor to confirm when a compatible release will be available. Apply this patch with high priority given the CVSS 7.5 severity and low barrier to exploitation. No configuration-only workaround mitigates the vulnerability; code-level fixes are necessary.

Detection guidance

Monitor FHIR endpoint logs for unusual or repetitive FHIRPath expression submissions, particularly those containing complex regex-like syntax or requests that cause prolonged CPU spikes. Correlate HTTP access logs with CPU utilization metrics to identify potential ReDoS attacks. Standard regex patterns that include nested quantifiers (e.g., (a+)+ or (a|a)* variants) or excessive alternation are common attack signatures. Host-based monitoring of CPU usage on FHIR servers can reveal when the vulnerable matches() function is being abused. After patching, establish a baseline for normal FHIRPath query performance to aid future anomaly detection.

Why prioritize this

This vulnerability merits urgent remediation despite not being on the KEV catalog. The CVSS 7.5 HIGH score reflects the combination of easy exploitability (AV:N/PR:N/UI:N) and direct service availability impact. The regression nature of this bug—a prior patch was incomplete—suggests the vulnerability may have been in production for some time, increasing exposure. Healthcare environments are particularly sensitive to availability issues, and unauthenticated ReDoS attacks are frequently used as staging points for larger attacks or competitive sabotage. Organizations with public-facing FHIR endpoints should prioritize this above lower-impact vulnerabilities.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) is driven by maximum exploitability ratings (AV:N/AC:L/PR:N/UI:N) and a severe availability impact (A:H). The attack vector is the network, no special conditions or user interaction are required, and authorization is not necessary. The scope is unchanged (single vulnerable component). The confidentiality and integrity impacts are none—attackers cannot read or modify data. However, the ability to completely deny service to an unauthenticated attacker warrants the HIGH classification. The score does not account for business context (healthcare) or organizational factors; your internal risk model should weight this accordingly.

Frequently asked questions