CVE-2026-55470

HAPI FHIR: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoS

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.10, the fix for CVE-2026-45367 incompletely patched the DSTU2 module, leaving FHIRPathEngine.matches() in org.hl7.fhir.dstu2/utils/FHIRPathEngine.java to call raw String.matches(sw) without RegexTimeout protection while replaceMatches() was updated, allowing an unauthenticated attacker to trigger catastrophic regex backtracking and exhaust server CPU. This issue is fixed in version 6.9.10.

Affected

hapifhir · org.hl7.fhir.core

CVSS v3.1 GITHUB

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.68% chance of exploitation in the next 30 days, 52nd percentile

Published

2026-07-08

Updated

2026-07-09

Proof-of-concept exploits (1)

• advisories/GHSA-fxj4-p9xp-37v5

Security advisories

• hapifhir/org.hl7.fhir.core/security/advisories/GHSA-fxj4-p9xp-37v5
• hapifhir/org.hl7.fhir.core/commit/56376f7986222626af061ca7fc27ee1ab030e590

References

• CVE Record
• NVD entry