CVE-2026-49485: CWE-1333: Inefficient Regular Expression Complexity in hapifhir org.hl7.fhir.core
A vulnerability in HAPI FHIR's org.hl7.fhir.core module allows denial of service via inefficient regular expression evaluation. Versions prior to 6.9.4.2 and between 6.9.5 and before 6.9.9 accept arbitrary FHIRPath expressions without sufficient input validation. The matches(), matchesFull(), and replaceMatches() functions pass user-controlled regex patterns to Java's Pattern.compile() and String.replaceAll() with an incomplete timeout mechanism, enabling catastrophic backtracking and CPU exhaustion. This issue is fixed in versions 6.9.9 and 6.9.4.2.
AI Analysis
Technical Summary
HAPI FHIR's FHIRPathEngine implementations in org.hl7.fhir.core versions before 6.9.4.2 and from 6.9.5 up to but not including 6.9.9 allow user-supplied regular expressions to be evaluated without adequate input validation or effective timeout controls. The functions matches(), matchesFull(), and replaceMatches() pass these regex patterns to Java's Pattern.compile() and String.replaceAll(), which can lead to catastrophic backtracking. This results in excessive CPU consumption and denial of service, particularly impacting the FHIR Validator HTTP endpoint. The vulnerability is addressed by fixes in versions 6.9.4.2 and 6.9.9.
Potential Impact
An attacker can cause a denial of service by submitting specially crafted FHIR resources containing malicious regular expressions that trigger catastrophic backtracking in the vulnerable functions. This leads to CPU exhaustion and service disruption of the FHIR Validator HTTP endpoint and other affected modules. There is no impact on confidentiality or integrity reported.
Mitigation Recommendations
This vulnerability is fixed in HAPI FHIR versions 6.9.4.2 and 6.9.9. Users should upgrade to at least one of these versions to remediate the issue. No other mitigation or workaround is indicated by the vendor advisory. Patch status is confirmed by the vendor advisory.
CVE-2026-49485: CWE-1333: Inefficient Regular Expression Complexity in hapifhir org.hl7.fhir.core
Description
A vulnerability in HAPI FHIR's org.hl7.fhir.core module allows denial of service via inefficient regular expression evaluation. Versions prior to 6.9.4.2 and between 6.9.5 and before 6.9.9 accept arbitrary FHIRPath expressions without sufficient input validation. The matches(), matchesFull(), and replaceMatches() functions pass user-controlled regex patterns to Java's Pattern.compile() and String.replaceAll() with an incomplete timeout mechanism, enabling catastrophic backtracking and CPU exhaustion. This issue is fixed in versions 6.9.9 and 6.9.4.2.
CVSS v3.1
Score 7.5high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
HAPI FHIR's FHIRPathEngine implementations in org.hl7.fhir.core versions before 6.9.4.2 and from 6.9.5 up to but not including 6.9.9 allow user-supplied regular expressions to be evaluated without adequate input validation or effective timeout controls. The functions matches(), matchesFull(), and replaceMatches() pass these regex patterns to Java's Pattern.compile() and String.replaceAll(), which can lead to catastrophic backtracking. This results in excessive CPU consumption and denial of service, particularly impacting the FHIR Validator HTTP endpoint. The vulnerability is addressed by fixes in versions 6.9.4.2 and 6.9.9.
Potential Impact
An attacker can cause a denial of service by submitting specially crafted FHIR resources containing malicious regular expressions that trigger catastrophic backtracking in the vulnerable functions. This leads to CPU exhaustion and service disruption of the FHIR Validator HTTP endpoint and other affected modules. There is no impact on confidentiality or integrity reported.
Mitigation Recommendations
This vulnerability is fixed in HAPI FHIR versions 6.9.4.2 and 6.9.9. Users should upgrade to at least one of these versions to remediate the issue. No other mitigation or workaround is indicated by the vendor advisory. Patch status is confirmed by the vendor advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-7cmj-v6x8-frvv
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-49485"]
- Ecosystems
- ["Maven"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6a50bac868715ace435892aa
Added to database: 07/10/2026, 09:26:32 UTC
Last enriched: 07/25/2026, 21:00:33 UTC
Last updated: 09/01/2026, 22:52:12 UTC
Views: 164
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.