CVE-2026-33180 hapifhir CVE debrief

Who should care

Healthcare organizations and developers using HAPI FHIR versions prior to 6.9.0 should be aware of this vulnerability. The exposure of sensitive information could lead to privacy concerns and potential impersonation of client requests. Immediate action is recommended to update to the patched version.

Technical summary

The vulnerability in HAPI FHIR occurs when the internal HTTP client sends headers to subsequent hosts during redirect handling. This could lead to the exposure of sensitive information, such as privacy-sensitive data or credentials that could be used to impersonate the client's request. The issue has been addressed in version 6.9.0. The CVSS score for this vulnerability is 7.5, indicating a high severity level. The vulnerability is categorized under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Defensive priority

High priority should be given to updating HAPI FHIR to version 6.9.0 or later. In the meantime, users should assess their exposure and consider compensating controls to mitigate the risk of sensitive information disclosure.

Recommended defensive actions

• Update HAPI FHIR to version 6.9.0 or later.
• Review and update HTTP client configurations to limit header forwarding during redirects.
• Monitor for and respond to potential misuse of exposed sensitive information.
• Conduct a thorough inventory of affected systems and prioritize updates.
• Implement additional security measures to protect sensitive information.

Evidence notes

The CVE-2026-33180 vulnerability was published on March 20, 2026, and modified on June 30, 2026. The vulnerability has a CVSS score of 7.5 and is categorized as CWE-200. The issue arises from the internal HTTP client in HAPI FHIR sending headers to subsequent hosts during redirect handling, potentially exposing sensitive information. The patch for this vulnerability is included in release 6.9.0.

Official resources