7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-49485

CVE-2026-49485: HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.9 and 6.9.4.2, all implementations of FHIRPathEngine accept arbitrary FHIRPath expressions and evaluate them without input validation, and the FHIRPath functions matches(), matchesFull(), and replaceMatches() pass user-controlled regular expressions to Java's Pattern.compile() and String.replaceAll() through an incomplete timeout utility. An attacker can send a resource containing an evil regex pattern that causes catastrophic backtracking, exhausting CPU resources and causing denial of service in the FHIR Validator HTTP endpoint and affected org.hl7.fhir.* modules. This issue is fixed in versions 6.9.9 and 6.9.4.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-49485

CVE-2026-49485:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
ca.uhn.hapi.fhir:org.hl7.fhir.dstu2	maven	>= 6.9.5, < 6.9.9	6.9.9
ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may	maven	>= 6.9.5, < 6.9.9	6.9.9
ca.uhn.hapi.fhir:org.hl7.fhir.dstu3	maven	>= 6.9.5, < 6.9.9	6.9.9
ca.uhn.hapi.fhir:org.hl7.fhir.r4	maven	>= 6.9.5, < 6.9.9	6.9.9
ca.uhn.hapi.fhir:org.hl7.fhir.r4b	maven	>= 6.9.5, < 6.9.9	6.9.9
ca.uhn.hapi.fhir:org.hl7.fhir.r5	maven	>= 6.9.5, < 6.9.9	6.9.9
ca.uhn.hapi.fhir:org.hl7.fhir.validation	maven	>= 6.9.5, < 6.9.9	6.9.9
ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli	maven	>= 6.9.5, < 6.9.9	6.9.9
ca.uhn.hapi.fhir:org.hl7.fhir.dstu2	maven	< 6.9.4.2	6.9.4.2
ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may	maven	< 6.9.4.2	6.9.4.2
ca.uhn.hapi.fhir:org.hl7.fhir.dstu3	maven	< 6.9.4.2	6.9.4.2
ca.uhn.hapi.fhir:org.hl7.fhir.r4	maven	< 6.9.4.2	6.9.4.2
ca.uhn.hapi.fhir:org.hl7.fhir.r4b	maven	< 6.9.4.2	6.9.4.2
ca.uhn.hapi.fhir:org.hl7.fhir.r5	maven	< 6.9.4.2	6.9.4.2
ca.uhn.hapi.fhir:org.hl7.fhir.validation	maven	< 6.9.4.2	6.9.4.2
ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli	maven	< 6.9.4.2	6.9.4.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Regular Expression Denial of Service (ReDoS) in the FHIRPathEngine. The advisory mentions the functions matches(), matchesFull(), and replaceMatches() as being affected. The analysis of the provided patches shows that the funcReplaceMatches method in the FHIRPathEngine for FHIR versions R4, R4B, and R5 was directly using String.replaceAll() with a user-controlled regular expression. This is unsafe and can lead to catastrophic backtracking if a malicious regex is provided. The fix was to replace the call to String.replaceAll() with a custom utility RegexTimeout.replaceAll() which enforces a timeout on the regex execution. While the advisory also mentions matches() and matchesFull(), the provided patches did not contain changes for these functions, suggesting they might have been using the timeout utility already, or were fixed in a different context. The core of the identified vulnerability is the unprotected use of replaceAll in funcReplaceMatches.

Vulnerable functions

org.hl7.fhir.r4.fhirpath.FHIRPathEngine.funcReplaceMatches

org.hl7.fhir.r4/src/main/java/org/hl7/fhir/r4/fhirpath/FHIRPathEngine.java

The function was using `String.replaceAll()` with a user-provided regex, which is vulnerable to Regular Expression Denial of Service (ReDoS). An attacker could provide a malicious regex pattern that causes catastrophic backtracking, leading to 100% CPU utilization.

org.hl7.fhir.r4b.fhirpath.FHIRPathEngine.funcReplaceMatches

org.hl7.fhir.r4b/src/main/java/org/hl7/fhir/r4b/fhirpath/FHIRPathEngine.java

org.hl7.fhir.r5.fhirpath.FHIRPathEngine.funcReplaceMatches

org.hl7.fhir.r5/src/main/java/org/hl7/fhir/r5/fhirpath/FHIRPathEngine.java

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.