CVE-2026-49485

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.9 and 6.9.4.2, all implementations of FHIRPathEngine accept arbitrary FHIRPath expressions and evaluate them without input validation, and the FHIRPath functions matches(), matchesFull(), and replaceMatches() pass user-controlled regular expressions to Java's Pattern.compile() and String.replaceAll() through an incomplete timeout utility. An attacker can send a resource containing an evil regex pattern that causes catastrophic backtracking, exhausting CPU resources and causing denial of service in the FHIR Validator HTTP endpoint and affected org.hl7.fhir.* modules. This issue is fixed in versions 6.9.9 and 6.9.4.2.

• CWE-400
• CWE-1333

• https://github.com/hapifhir/org.hl7.fhir.core/commit/109c88837c032ef399b2eb87ddde86692065cf41
• https://github.com/hapifhir/org.hl7.fhir.core/commit/e08982d2b6f6dcd6c670a762d9cf999179fbe4ed
• https://github.com/hapifhir/org.hl7.fhir.core/pull/2463
• https://github.com/hapifhir/org.hl7.fhir.core/releases/tag/6.9.4.2
• https://github.com/hapifhir/org.hl7.fhir.core/releases/tag/6.9.9
• https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-7cmj-v6x8-frvv

Published

Jul 17, 2026

Last Modified

Jul 23, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-49472FreeSWITCH is a Software Defined Telecom Stack enabling the …5.3
• CVE-2026-49475FreeSWITCH is a Software Defined Telecom Stack enabling the …7.5
• CVE-2026-49476Soup Sieve is a CSS selector library designed to be used wit…7.5
• CVE-2026-49477Soup Sieve is a CSS selector library designed to be used wit…7.5
• CVE-2026-4948A flaw was found in firewalld. A local unprivileged user can…5.5
• CVE-2026-49482ClipBucket v5 is an open source video sharing platform. Prio…4.3
• CVE-2026-49486The Apache Airflow FTP provider's `FTPSHook.get_conn()` crea…7.5
• CVE-2026-49487In Apache Airflow before 3.3.0, the REST API task-instance d…6.5
• CVE-2026-49488Improper Limitation of a Pathname to a Restricted Directory …6.5
• CVE-2026-49489OpenCATS through 0.9.7.4 contains a sql injection vulnerabil…8.5
• CVE-2026-4949The Paid Membership Plugin, Ecommerce, User Registration For…4.3
• CVE-2026-49490OpenCATS from version 0.9.1a contains an SQL injection vulne…8.6