---
id: CVE-2026-34359
title: >-
  HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare
  interoperability in Java
summary: >-
  HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare
  interoperability in Java. Prior to version 6.9.4,
  ManagedWebAccessUtils.getServer() uses String.startsWith() to match request
  URLs against configured server U…
severity: high
cvss: 7.4
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'
cwe:
  - CWE-346
vendor: hapifhir
product: hl7_fhir_core
affected:
  - hl7_fhir_core < 6.9.4
patched:
  - hl7_fhir_core 6.9.4
published: '2026-03-31'
updated: '2026-07-24'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-34359'
references:
  - url: >-
      https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-fgv2-4q4g-wc35
    label: security-advisories@github.com
  - url: >-
      https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-fgv2-4q4g-wc35
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00158
epssPercentile: 0.05394
ingestedAt: '2026-07-24T20:38:02.872Z'
---

## Overview

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.4, ManagedWebAccessUtils.getServer() uses String.startsWith() to match request URLs against configured server URLs for authentication credential dispatch. Because configured server URLs (e.g., http://tx.fhir.org) lack a trailing slash or host boundary check, an attacker-controlled domain like http://tx.fhir.org.attacker.com matches the prefix and receives Bearer tokens, Basic auth credentials, or API keys when the HTTP client follows a redirect to that domain. This issue has been patched in version 6.9.4.

## Affected

- `hl7_fhir_core < 6.9.4`

## Remediation

Upgrade past the affected range:

- `hl7_fhir_core 6.9.4`