7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-33180

CVE-2026-33180: HAPI FHIR HTTP authentication leak in redirects

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.0, when setting headers in HTTP requests, the internal HTTP client sends headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the Location: response header value. Sending the same set of headers to subsequent hosts is a problem as this header often contains privacy sensitive information or data that could allow others to impersonate the client's request. This issue has been patched in release 6.9.0. No known workarounds are available.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-33180

CVE-2026-33180:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
ca.uhn.hapi.fhir:org.hl7.fhir.utilities	maven	< 6.9.0	6.9.0
ca.uhn.hapi.fhir:org.hl7.fhir.convertors	maven	< 6.9.0	6.9.0
ca.uhn.hapi.fhir:org.hl7.fhir.dstu2	maven	< 6.9.0	6.9.0
ca.uhn.hapi.fhir:org.hl7.fhir.dstu3	maven	< 6.9.0	6.9.0
ca.uhn.hapi.fhir:org.hl7.fhir.dstu3.support	maven	< 6.9.0	6.9.0
ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may	maven	< 6.9.0	6.9.0
ca.uhn.hapi.fhir:org.hl7.fhir.model	maven	< 6.9.0	6.9.0
ca.uhn.hapi.fhir:org.hl7.fhir.r4	maven	< 6.9.0	6.9.0
ca.uhn.hapi.fhir:org.hl7.fhir.r4b	maven	< 6.9.0	6.9.0
ca.uhn.hapi.fhir:org.hl7.fhir.r5	maven	< 6.9.0	6.9.0
ca.uhn.hapi.fhir:org.hl7.fhir.validation	maven	< 6.9.0	6.9.0
ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli	maven	< 6.9.0	6.9.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the org.hl7.fhir.utilities.http.SimpleHTTPClient class, specifically within the get method that handles HTTP GET requests and automatically follows redirects. The vulnerability description states that when following a 30x redirect, the client sends the same set of headers, including potentially sensitive authentication headers, to the new host specified in the Location header. Analysis of the commits between the vulnerable version (6.8.2) and the patched version (6.9.0) reveals the exact fix. Commit 6b615880dce6730d15b4343af3211654e9b202c4 introduces a check within the redirect handling logic of the get method. A new isNotSameHost method is added and used to determine if the redirect target has a different host than the original request. If the host is different, a flag setAuthenticationHeaders is set to false, which prevents the setAuthenticationHeader method from being called for the subsequent request to the new host. This directly addresses the reported vulnerability by ensuring authentication headers are not leaked to external hosts during redirects. A later commit (3871cc69c0516628c19adf824e5e7b0a0531511b) further refactors this by introducing an IHTTPAuthenticationProvider interface, which centralizes the logic for when to provide authentication headers, making the solution more robust. The primary vulnerable function is org.hl7.fhir.utilities.http.SimpleHTTPClient.get as it contains the flawed redirect logic.

Vulnerable functions

org.hl7.fhir.utilities.http.SimpleHTTPClient.get

org.hl7.fhir.utilities/src/main/java/org/hl7/fhir/utilities/http/SimpleHTTPClient.java

The `get` method in `SimpleHTTPClient` follows HTTP redirects. Prior to the patch, when a redirect (30x response) occurred, the client would make a new request to the location specified in the `Location` header, but it would re-use the same headers from the original request. This included sensitive authentication headers like `Authorization`. If the redirect was to a different, potentially malicious host, these headers would be leaked, allowing an attacker to impersonate the client. The vulnerable function is `get` because it contains the redirect handling logic that fails to strip sensitive headers.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.