CyberRota Analysis
AI-GeneratedThe vulnerability affects the HAPI FHIR implementation in Java, specifically within the DSTU2 module, where the FHIRPathEngine.matches() function lacks proper RegexTimeout protection. This oversight allows unauthenticated attackers to exploit catastrophic regex backtracking, potentially leading to significant CPU exhaustion and denial of service. Organizations using HAPI FHIR versions prior to 6.9.10 should prioritize upgrading to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.10, the fix for CVE-2026-45367 incompletely patched the DSTU2 module, leaving FHIRPathEngine.matches() in org.hl7.fhir.dstu2/utils/FHIRPathEngine.java to call raw String.matches(sw) without RegexTimeout protection while replaceMatches() was updated, allowing an unauthenticated attacker to trigger catastrophic regex backtracking and exhaust server CPU. This issue is fixed in version 6.9.10.
Related CVEs
Other vulnerabilities affecting the same vendor(s)