CVE-2026-49485High· 7.5▾ Twilightorg.hl7.fhir.core: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 18.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.7%
0.7% → 0.7%
All implementations of FHIRPathEngine accept arbitrary FHIRPath expressions and evaluate them without input validation. The utility intended to secure this evaluation did so incorrectly, and did not fully cover all places in which evaluation was being done. An attacker can send a resource containing an evil regex pattern that causes catastrophic backtracking, exhausting system resources, and causing Denial-of-Service.
The vulnerability exists in regex execution in FHIRPathEngine implementations across multiple code modules. The FHIRPath functions matches(), matchesFull(), and replaceMatches() pass user-controlled regular expressions to Java's Pattern.compile() and String.replaceAll() through a utility class designed to time out after a specified interval. That utility correctly cancelled a single executor thread and returned with an exception, but the execution within the thread had no means to listen for this cancellation and would persist. Furthermore, three modules contained method calls in FHIRPathEngine that were not protected by this utility class.
Java's Pattern.compile() with a pattern like (a+)+$ against input "aaaaaaaaaaaaaaaaaaaaaa!" causes exponential backtracking (O(2^n) time complexity).
CPU Exhaustion: The exponential backtracking in Java's regex engine consumes 100% of a CPU core for the duration of the hang (effectively infinite for sufficiently long input strings) for callers of FHIRPathEngine.
ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 >= 6.9.5, < 6.9.9ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may >= 6.9.5, < 6.9.9ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 >= 6.9.5, < 6.9.9ca.uhn.hapi.fhir:org.hl7.fhir.r4 >= 6.9.5, < 6.9.9ca.uhn.hapi.fhir:org.hl7.fhir.r4b >= 6.9.5, < 6.9.9ca.uhn.hapi.fhir:org.hl7.fhir.r5 >= 6.9.5, < 6.9.9ca.uhn.hapi.fhir:org.hl7.fhir.validation >= 6.9.5, < 6.9.9ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli >= 6.9.5, < 6.9.9ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 < 6.9.4.2ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may < 6.9.4.2ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 < 6.9.4.2ca.uhn.hapi.fhir:org.hl7.fhir.r4 < 6.9.4.2ca.uhn.hapi.fhir:org.hl7.fhir.r4b < 6.9.4.2ca.uhn.hapi.fhir:org.hl7.fhir.r5 < 6.9.4.2ca.uhn.hapi.fhir:org.hl7.fhir.validation < 6.9.4.2ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli < 6.9.4.2Upgrade to a patched release:
ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 6.9.9ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may 6.9.9ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 6.9.9ca.uhn.hapi.fhir:org.hl7.fhir.r4 6.9.9ca.uhn.hapi.fhir:org.hl7.fhir.r4b 6.9.9ca.uhn.hapi.fhir:org.hl7.fhir.r5 6.9.9ca.uhn.hapi.fhir:org.hl7.fhir.validation 6.9.9ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli 6.9.9ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 6.9.4.2ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may 6.9.4.2ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 6.9.4.2ca.uhn.hapi.fhir:org.hl7.fhir.r4 6.9.4.2ca.uhn.hapi.fhir:org.hl7.fhir.r4b 6.9.4.2ca.uhn.hapi.fhir:org.hl7.fhir.r5 6.9.4.2ca.uhn.hapi.fhir:org.hl7.fhir.validation 6.9.4.2ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli 6.9.4.2Connected by shared product, vendor, weakness, or advisory.
CVE-2026-55470High· 7.5HAPI FHIR: Incomplete fix for CVE-2026-45367: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoS
CVE-2026-24001High· 7.5jsdiff is a JavaScript text differencing implementation
CVE-2026-89407High· 7.5NumberInput.looksLikeValidNumber() in FasterXML jackson-core pre-validates "stringified numbers" with two regular expressions: PATTERN_FLOAT ([+-]?[0-9]*[\.]?[0-9]+([eE][+-]?[0-9]+)?), present since 2.17.0, and PATTERN_FLOAT_TRAILING_DOT…
CVE-2026-86000Medium· 5.3Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4
CVE-2026-85999Medium· 5.3Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4
CVE-2026-92114Medium· 5.3A vulnerability was identified in a2ui-project a2ui up to 0.10.6