PT-2026-56841 · Maven · Ca.Uhn.Hapi.Fhir:Org.Hl7.Fhir.Dstu2+7
Publicado
2026-07-09
·
Atualizado
2026-07-09
·
CVE-2026-49485
CVSS v3.1
7.5
Alta
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Summary
All implementations of FHIRPathEngine accept arbitrary FHIRPath expressions and evaluate them without input validation. The utility intended to secure this evaluation did so incorrectly, and did not fully cover all places in which evaluation was being done. An attacker can send a resource containing an evil regex pattern that causes catastrophic backtracking, exhausting system resources, and causing Denial-of-Service.
Details
The vulnerability exists in regex execution in FHIRPathEngine implementations across multiple code modules. The FHIRPath functions matches(), matchesFull(), and replaceMatches() pass user-controlled regular expressions to Java's Pattern.compile() and String.replaceAll() through a utility class designed to time out after a specified interval. That utility correctly cancelled a single executor thread and returned with an exception, but the execution within the thread had no means to listen for this cancellation and would persist. Furthermore, three modules contained method calls in FHIRPathEngine that were not protected by this utility class.
Why this is exploitable:
Java's Pattern.compile() with a pattern like (a+)+$ against input "aaaaaaaaaaaaaaaaaaaaaa!" causes exponential backtracking (O(2^n) time complexity).
Impact
CPU Exhaustion: The exponential backtracking in Java's regex engine consumes 100% of a CPU core for the duration of the hang (effectively infinite for sufficiently long input strings) for callers of FHIRPathEngine.
Correção
DoS
Resource Exhaustion
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Ca.Uhn.Hapi.Fhir:Org.Hl7.Fhir.Dstu2
Ca.Uhn.Hapi.Fhir:Org.Hl7.Fhir.Dstu2016May
Ca.Uhn.Hapi.Fhir:Org.Hl7.Fhir.Dstu3
Ca.Uhn.Hapi.Fhir:Org.Hl7.Fhir.R4
Ca.Uhn.Hapi.Fhir:Org.Hl7.Fhir.R4B
Ca.Uhn.Hapi.Fhir:Org.Hl7.Fhir.R5
Ca.Uhn.Hapi.Fhir:Org.Hl7.Fhir.Validation
Ca.Uhn.Hapi.Fhir:Org.Hl7.Fhir.Validation.Cli