Bug 2498308 (CVE-2026-55470)

Summary: CVE-2026-55470 ca.uhn.hapi.fhir/org.hl7.fhir.dstu2: ca.uhn.hapi.fhir/org.hl7.fhir.convertors: ca.uhn.hapi.fhir/org.hl7.fhir.validation: ca.uhn.hapi.fhir/org.hl7.fhir.validation.cli: HAPI FHIR: Denial of Service via Regular Expression Backtracking in D ...
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: anujha, asoldano, bbaranow, bmaxwell, bstansbe, dlofthou, fmongiar, istudens, ivassile, iweiss, janstey, jnethert, mosmerov, msvehla, nwallace, pberan, pesilva, pjindal, pmackay, rstancel, thjenkin, vdosoudi
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in HAPI FHIR, a Java implementation of the HL7 FHIR standard. The fix for a previous vulnerability (CVE-2026-45367) was incomplete in the DSTU2 module. Specifically, the FHIRPathEngine.matches() function in org.hl7.fhir.dstu2 did not include protection against regular expression timeouts. This allows an unauthenticated attacker to submit a specially crafted FHIRPath expression, triggering catastrophic regular expression (regex) backtracking. The consequence is a Regular Expression Denial of Service (ReDoS), which can exhaust server CPU resources and lead to service disruption.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-07-08 22:03:14 UTC 
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.10, the fix for CVE-2026-45367 incompletely patched the DSTU2 module, leaving FHIRPathEngine.matches() in org.hl7.fhir.dstu2/utils/FHIRPathEngine.java to call raw String.matches(sw) without RegexTimeout protection while replaceMatches() was updated, allowing an unauthenticated attacker to trigger catastrophic regex backtracking and exhaust server CPU. This issue is fixed in version 6.9.10.
Comment 3 errata-xmlrpc 2026-08-13 23:28:34 UTC 
This issue has been addressed in the following products:

  Red Hat Build of Apache Camel 4.18 for Quarkus 3.33

Via RHSA-2026:54776 https://access.redhat.com/errata/RHSA-2026:54776