org.hl7.fhir.core: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

• CVE-2026-49485: 0.68% estimated exploitation activity in the next 30 days; percentile 52.61 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

Summary All implementations of FHIRPathEngine accept arbitrary FHIRPath expressions and evaluate them without input validation. The utility intended to secure this evaluation did so incorrectly, and did not fully cover all places in which evaluation was being done. An attacker can send a resource containing an evil regex pattern that causes catastrophic backtracking, exhausting system resources, and causing Denial-of-Service. Details The vulnerability exists in regex execution in FHIRPathEngine implementations across multiple code modules. The FHIRPath functions matches(), matchesFull(), and replaceMatches() pass user-controlled regular expressions to Java's Pattern.compile() and String.replaceAll() through a utility class designed to time out after a specified interval. That utility correctly cancelled a single executor thread and returned with an exception, but the execution within the thread had no means to listen for this cancellation and would persist. Furthermore, three modules…

Published by the source

9 Jul 2026, 13:43 UTC

Last modified by the source

9 Jul 2026, 13:43 UTC

Source last checked

26 Oct 2026, 16:54 UTC

1. Revision 1 · created · 26 Oct 2026

   Published from ghsa record GHSA-7cmj-v6x8-frvv

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2026-49485

Advisory: org.hl7.fhir.core: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint
IDs: CVE-2026-49485, GHSA-7cmj-v6x8-frvv
Record: https://patchnext.com/advisories/cve-2026-49485 (revision 1, source checked 26 Oct 2026, 16:54 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: High (CVSS 7.5)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli 6.9.9, 6.9.4.2; ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may 6.9.9, 6.9.4.2; ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 6.9.9, 6.9.4.2; ca.uhn.hapi.fhir:org.hl7.fhir.validation 6.9.9, 6.9.4.2; ca.uhn.hapi.fhir:org.hl7.fhir.r4b 6.9.9, 6.9.4.2; ca.uhn.hapi.fhir:org.hl7.fhir.r4 6.9.9, 6.9.4.2; ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 6.9.9, 6.9.4.2; ca.uhn.hapi.fhir:org.hl7.fhir.r5 6.9.9, 6.9.4.2. A vendor fix does not mean a deployment is fixed.

## Affected components
- Maven ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli: affected >= 6.9.5, < 6.9.9; < 6.9.4.2; fixed in 6.9.9, 6.9.4.2
- Maven ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may: affected >= 6.9.5, < 6.9.9; < 6.9.4.2; fixed in 6.9.9, 6.9.4.2
- Maven ca.uhn.hapi.fhir:org.hl7.fhir.dstu3: affected >= 6.9.5, < 6.9.9; < 6.9.4.2; fixed in 6.9.9, 6.9.4.2
- Maven ca.uhn.hapi.fhir:org.hl7.fhir.validation: affected >= 6.9.5, < 6.9.9; < 6.9.4.2; fixed in 6.9.9, 6.9.4.2
- Maven ca.uhn.hapi.fhir:org.hl7.fhir.r4b: affected >= 6.9.5, < 6.9.9; < 6.9.4.2; fixed in 6.9.9, 6.9.4.2
- Maven ca.uhn.hapi.fhir:org.hl7.fhir.r4: affected >= 6.9.5, < 6.9.9; < 6.9.4.2; fixed in 6.9.9, 6.9.4.2
- Maven ca.uhn.hapi.fhir:org.hl7.fhir.dstu2: affected >= 6.9.5, < 6.9.9; < 6.9.4.2; fixed in 6.9.9, 6.9.4.2
- Maven ca.uhn.hapi.fhir:org.hl7.fhir.r5: affected >= 6.9.5, < 6.9.9; < 6.9.4.2; fixed in 6.9.9, 6.9.4.2

## Suggested inspection (read-only)
- Maven ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli: check the installed version with your package manager.
- Maven ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may: check the installed version with your package manager.
- Maven ca.uhn.hapi.fhir:org.hl7.fhir.dstu3: check the installed version with your package manager.
- Maven ca.uhn.hapi.fhir:org.hl7.fhir.validation: check the installed version with your package manager.
- Maven ca.uhn.hapi.fhir:org.hl7.fhir.r4b: check the installed version with your package manager.
- Maven ca.uhn.hapi.fhir:org.hl7.fhir.r4: check the installed version with your package manager.
- Maven ca.uhn.hapi.fhir:org.hl7.fhir.dstu2: check the installed version with your package manager.
- Maven ca.uhn.hapi.fhir:org.hl7.fhir.r5: check the installed version with your package manager.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli, ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may, ca.uhn.hapi.fhir:org.hl7.fhir.dstu3, ca.uhn.hapi.fhir:org.hl7.fhir.validation, ca.uhn.hapi.fhir:org.hl7.fhir.r4b, ca.uhn.hapi.fhir:org.hl7.fhir.r4, ca.uhn.hapi.fhir:org.hl7.fhir.dstu2, ca.uhn.hapi.fhir:org.hl7.fhir.r5.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-7cmj-v6x8-frvv (GitHub-reviewed advisory GHSA-7cmj-v6x8-frvv lists affected ranges: Maven ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 >=6.9.5 =0 =6.9.5 =0 =6.9.5 =0 =6.9.5 =0 =6.9.5 =0 =6.9.5 =0 <6.9.4.2;…)

Commands are suggestions: review each one before running it.