Back to list

HAPI FHIR: Incomplete fix for CVE-2026-45367: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoS — CVE-2026-55470

GitHub · GitHub · CVE-2026-55470

ID
CVE-2026-55470
Date
Activity
Source
GitHub
Vendor
GitHub
Threat
high
CVSS
7.5

Summary

## Summary The fix for CVE-2026-45367 added `RegexTimeout` protection to the `matches()` function in DSTU2016MAY, DSTU3, R4, R4B, and R5, but the DSTU2 module was incompletely patched. In `org.hl7.fhir.dstu2`, `replaceMatches()` was updated while `matches()` at line 2462 still calls the raw `String.matches(sw)` without any timeout, allowing an unauthenticated attacker to trigger catastrophic regex backtracking and…

Product

maven: ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 | maven: ca.uhn.hapi.fhir:org.hl7.fhir.convertors | maven: ca.uhn.hapi.fhir:org.hl7.fhir.validation | maven: ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli

What to do

General, cautious steps (verify details in the official source):

  • Prioritize patching or mitigation immediately (treat as actively risky).
  • Identify affected product versions in your inventory and verify whether you are impacted.
  • Apply vendor patches/updates or recommended mitigations as soon as available.
  • Read the official advisory for exact affected versions and remediation steps.

Official advisory

Related advisories

GitHub GitHub 2026-W25