Is CVE-2026-45367 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-45367?

CVE-2026-45367 has a CVSS v3 severity of HIGH (7.5).

Back

CVE-2026-45367

Description

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.7, the FHIRPathEngine implementation passes user-controlled regular expressions from matches(), matchesFull(), and replaceMatches() to Java regex operations without effective timeouts, allowing catastrophic backtracking and denial of service. This issue is fixed in version 6.9.7.