PT-2026-26206 · Hapi Fhir · Hapi Fhir

Elliotsilver · Publicado 2026-03-18 · Atualizado 2026-05-26 · CVE-2026-33180

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions HAPI FHIR versions prior to 6.9.0

Description HAPI FHIR, a Java implementation of the HL7 FHIR standard, is affected by an issue where HTTP headers, potentially containing privacy-sensitive information, are sent to both the initial host and any subsequent hosts encountered during HTTP redirects. This occurs when the internal HTTP client follows redirects (30X HTTP response codes) and transmits the same headers to the host specified in the Location response header. This could allow for impersonation of the client's request.

Recommendations Update to HAPI FHIR version 6.9.0 or later.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2026-33180

GHSA-P7M9-V2CM-2H7M

Produtos afetados

Hapi Fhir

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33180.json · Exploit
• https://github.com/hapifhir/org.hl7.fhir.core · Nota
• https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-p7m9-v2cm-2h7m · Nota
• https://osv.dev/vulnerability/ROOT-APP-MAVEN-CVE-2026-33180 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-p7m9-v2cm-2h7m · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2035262141662364132 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-33180 · Nota de Segurança
• https://twitter.com/pulsepatchio/status/2034644944624001373 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-33180 · Aviso do Fabricante