These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-49485 is a denial of service vulnerability in HAPI FHIR, a Java implementation of the HL7 FHIR standard for healthcare interoperability. The vulnerability exists in the FHIRPathEngine, which accepts arbitrary FHIRPath expressions and evaluates them without input validation. Specifically, the FHIRPath functions matches(), matchesFull(), and replaceMatches() pass user-controlled regular expressions [truncated]
CVE-2026-45367 is a denial of service vulnerability in HAPI FHIR prior to 6.9.7. The FHIRPathEngine implementation passes user-controlled regular expressions to Java regex operations without effective timeouts, allowing catastrophic backtracking and denial of service. This issue is fixed in version 6.9.7. Users should review their current version and update as necessary.
CVE-2026-55471 is an XML External Entity injection vulnerability in HAPI FHIR prior to 6.9.10. The issue allows an attacker to trigger XML External Entity injection for local file disclosure and blind XXE or SSRF to arbitrary URLs reachable from the host. This vulnerability exists in the org.hl7.fhir.utilities.XsltUtilities saxonTransform(...) overloads, which instantiated a bare net.sf.saxon.TransformerF [truncated]
CVE-2026-34361 is a critical vulnerability in HAPI FHIR, a Java implementation of the HL7 FHIR standard. The FHIR Validator HTTP service exposes an unauthenticated /loadIG endpoint that makes outbound HTTP requests to attacker-controlled URLs. This allows an attacker to steal authentication tokens (Bearer, Basic, API keys) configured for legitimate FHIR servers by registering a domain that prefix-matches [truncated]
CVE-2026-33180 is a high-severity vulnerability in HAPI FHIR, a Java implementation of the HL7 FHIR standard for healthcare interoperability. The issue arises from the internal HTTP client sending headers to subsequent hosts when following redirects, potentially exposing sensitive information. This vulnerability has been patched in release 6.9.0. Users are advised to update to the latest version to mitiga [truncated]