Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

ca.uhn.hapi.fhir:org.hl7.fhir.model

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 9.8MavenPublished

    HAPI FHIR HTTP authentication leak in redirects

    CVE-2026-33180 · GHSA-p7m9-v2cm-2h7m

    Affected
    • Maven ca.uhn.hapi.fhir:org.hl7.fhir.model < 6.9.0
    Fixed in
    6.9.0· Vendor fix available
    Issue
    Impact When setting headers in HTTP requests, the internal HTTP client sends headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the Location: response header value. Sending the same set of headers to subsequent hosts is a problem as this header often contains privacy sensitive information or data that could allow others to impersonate the client's request. Patches This issue has been patched in release 6.8.3 Workarounds None.

    Recommended action: Upgrade to 6.9.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →