CyberRota Analysis
AI-GeneratedThe vulnerability affects the HAPI FHIR implementation of the HL7 FHIR standard in Java, specifically in its FHIRPathEngine, where user-controlled regular expressions can lead to catastrophic backtracking during regex operations. This can result in denial of service, impacting the availability of applications relying on this library. Organizations utilizing HAPI FHIR versions prior to 6.9.7 should prioritize updating to the latest version to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.7, the FHIRPathEngine implementation passes user-controlled regular expressions from matches(), matchesFull(), and replaceMatches() to Java regex operations without effective timeouts, allowing catastrophic backtracking and denial of service. This issue is fixed in version 6.9.7.