hl7_fhir_core vulnerabilities

CVEs whose affected-version data names the hl7_fhir_core package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

3 CVEsRSS

CVE-2026-34361Critical· 9.3

5mo ago

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.4, the FHIR Validator HTTP service exposes an unauthenticated "/loadIG" endpoint that makes outbound HTTP reque…

▾ Midnighthapifhir · hl7_fhir_coreEPSS 0.30%via NVD

CVE-2026-34360Medium· 5.8

5mo ago

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.4, the /loadIG HTTP endpoint in the FHIR Validator HTTP service accepts a user-supplied URL via JSON body and m…

▾ Sunlithapifhir · hl7_fhir_coreEPSS 0.24%via NVD

CVE-2026-34359High· 7.4

5mo ago

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.4, ManagedWebAccessUtils.getServer() uses String.startsWith() to match request URLs against configured server U…

▾ Twilighthapifhir · hl7_fhir_coreEPSS 0.16%via NVD