CVE-2026-45367

{
  "id": "CVE-2026-45367",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-16T17:16:56.293",
  "lastModified": "2026-10-24T20:10:00.137",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.7, the FHIRPathEngine implementation passes user-controlled regular expressions from matches(), matchesFull(), and replaceMatches() to Java regex operations without effective timeouts, allowing catastrophic backtracking and denial of service. This issue is fixed in version 6.9.7."
    },
    {
      "lang": "es",
      "value": "HAPI FHIR es una implementación completa del estándar HL7 FHIR para la interoperabilidad sanitaria en Java. Antes de la versión 6.9.7, la implementación de FHIRPathEngine pasa expresiones regulares controladas por el usuario de matches(), matchesFull() y replaceMatches() a operaciones de expresiones regulares de Java sin tiempos de espera efectivos, lo que permite un retroceso catastrófico y denegación de servicio. Este problema se ha solucionado en la versión 6.9.7."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "hapifhir",
          "product": "org.hl7.fhir.core",
          "versions": [
            {
              "version": "< 6.9.7",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-18T02:59:58.378253Z",
          "id": "CVE-2026-45367",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1333"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/hapifhir/org.hl7.fhir.core/commit/275d015c680ce9f90cbe285596e50118e472bf24",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/hapifhir/org.hl7.fhir.core/commit/e08982d2b6f6dcd6c670a762d9cf999179fbe4ed",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/hapifhir/org.hl7.fhir.core/pull/2403",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/hapifhir/org.hl7.fhir.core/pull/2463",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/hapifhir/org.hl7.fhir.core/releases/tag/6.9.7",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-3653-68v6-rq57",
      "source": "[email protected]"
    }
  ]
}