PT-2026-41778 · Maven · Ca.Uhn.Hapi.Fhir:Org.Hl7.Fhir.Dstu2+7

Published

2026-05-18

·

Updated

2026-05-18

·

CVE-2026-45367

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

All implementations of FHIRPathEngine accept arbitrary FHIRPath expressions and evaluate them without input validation. The FHIRPath functions matches(), matchesFull(), and replaceMatches() pass user-controlled regular expressions directly to Java's Pattern.compile() and String.replaceAll() without complexity checks or timeouts. An attacker can send a resource containing an evil regex pattern that causes catastrophic backtracking, exhausting system resources, and causing Denial-of-Service.

Details

The vulnerability exists in regex execution in FHIRPathEngine implementations across multiple code modules. For example the org.hl7.fhir.r5 module:
Entry point 1 — FHIRPathEngine.java:5929 (R5 funcMatches):
private List<Base> funcMatches(ExecutionContext context, List<Base> focus, ExpressionNode exp) {
  String sw = convertToString(swb); // attacker-controlled regex pattern
  // ...
  Pattern p = Pattern.compile("(?s)" + sw); // VULNERABLE: no complexity check
  Matcher m = p.matcher(st);        // no timeout
  boolean ok = m.find();
Entry point 2 — FHIRPathEngine.java:5951 (R5 funcMatchesFull):
Pattern p = Pattern.compile("(?s)" + sw); // VULNERABLE: same pattern
Matcher m = p.matcher(st);
boolean ok = m.matches();
Entry point 3 — FHIRPathEngine.java:5120 (R5 funcReplaceMatches):
result.add(new StringType(convertToString(focus.get(0))
  .replaceAll(regex, repl)).noExtensions()); // VULNERABLE: replaceAll uses Pattern internally
The same vulnerabilities exist in the dstu2, dstu2016may, dstu3, r4, and r4b modules, and the FHIRPathEngine is used in the validation module functionality.
Why this is exploitable:
  • No timeout mechanism covers FHIRPath evaluation — the ValidationTimeout class only protects InstanceValidator operations, not evaluateFhirPath()
  • Java's Pattern.compile() with a pattern like (a+)+$ against input "aaaaaaaaaaaaaaaaaaaaaa!" causes exponential backtracking (O(2^n) time complexity)

Impact

  • CPU Exhaustion: The exponential backtracking in Java's regex engine consumes 100% of a CPU core for the duration of the hang (effectively infinite for sufficiently long input strings) for callers of FHIRPathEngine.

Fix

DoS

Weakness Enumeration

CWE-1333

Related Identifiers

CVE-2026-45367
GHSA-3653-68V6-RQ57

Affected Products

Ca.Uhn.Hapi.Fhir:Org.Hl7.Fhir.Dstu2
Ca.Uhn.Hapi.Fhir:Org.Hl7.Fhir.Dstu2016May
Ca.Uhn.Hapi.Fhir:Org.Hl7.Fhir.Dstu3
Ca.Uhn.Hapi.Fhir:Org.Hl7.Fhir.R4
Ca.Uhn.Hapi.Fhir:Org.Hl7.Fhir.R4B
Ca.Uhn.Hapi.Fhir:Org.Hl7.Fhir.R5
Ca.Uhn.Hapi.Fhir:Org.Hl7.Fhir.Validation
Ca.Uhn.Hapi.Fhir:Org.Hl7.Fhir.Validation.Cli