CVE-2026-49485

{
  "id": "CVE-2026-49485",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-17T22:17:16.893",
  "lastModified": "2026-10-24T20:10:00.137",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.9 and 6.9.4.2, all implementations of FHIRPathEngine accept arbitrary FHIRPath expressions and evaluate them without input validation, and the FHIRPath functions matches(), matchesFull(), and replaceMatches() pass user-controlled regular expressions to Java's Pattern.compile() and String.replaceAll() through an incomplete timeout utility. An attacker can send a resource containing an evil regex pattern that causes catastrophic backtracking, exhausting CPU resources and causing denial of service in the FHIR Validator HTTP endpoint and affected org.hl7.fhir.* modules. This issue is fixed in versions 6.9.9 and 6.9.4.2."
    },
    {
      "lang": "es",
      "value": "HAPI FHIR es una implementación completa del estándar HL7 FHIR para la interoperabilidad sanitaria en Java. Antes de las versiones 6.9.9 y 6.9.4.2, todas las implementaciones de FHIRPathEngine aceptan expresiones FHIRPath arbitrarias y las evalúan sin validación de entrada, y las funciones FHIRPath matches(), matchesFull() y replaceMatches() pasan expresiones regulares controladas por el usuario a Pattern.compile() y String.replaceAll() de Java a través de una utilidad de tiempo de espera incompleta. Un atacante puede enviar un recurso que contenga un patrón de regex malicioso que cause un retroceso catastrófico, agotando los recursos de la CPU y provocando una denegación de servicio en el endpoint HTTP del validador FHIR y en los módulos org.hl7.fhir.* afectados. Este problema está solucionado en las versiones 6.9.9 y 6.9.4.2."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "hapifhir",
          "product": "org.hl7.fhir.core",
          "versions": [
            {
              "version": "< 6.9.4.2",
              "status": "affected"
            },
            {
              "version": ">= 6.9.5, < 6.9.9",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-20T13:45:18.499715Z",
          "id": "CVE-2026-49485",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        },
        {
          "lang": "en",
          "value": "CWE-1333"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/hapifhir/org.hl7.fhir.core/commit/109c88837c032ef399b2eb87ddde86692065cf41",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/hapifhir/org.hl7.fhir.core/commit/e08982d2b6f6dcd6c670a762d9cf999179fbe4ed",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/hapifhir/org.hl7.fhir.core/pull/2463",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/hapifhir/org.hl7.fhir.core/releases/tag/6.9.4.2",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/hapifhir/org.hl7.fhir.core/releases/tag/6.9.9",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-7cmj-v6x8-frvv",
      "source": "[email protected]"
    }
  ]
}