org.hl7.fhir.core: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint

Date Jul 9, 2026

Type Vendor advisory

Signal High-risk advisory

Vendor / Product Maven · ca.uhn.hapi.fhir:org.hl7.fhir.dstu2

CVE CVE-2026-49485

High-risk advisory CVE-2026-49485

Summary

org.hl7.fhir.core: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint

Why it matters

GitHub has published a reviewed security advisory for ca.uhn.hapi.fhir:org.hl7.fhir.dstu2. Prioritize it with other application dependency updates.

Operator check

Check whether ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 is present in application dependency manifests, lockfiles, or build images. Review the GitHub advisory and upgrade to a patched version where available.

Sources

GitHub Advisory GHSA-7cmj-v6x8-frvv NVD — CVE-2026-49485 Source reference

PatchBrief uses public sources. It does not scan environments, verify exposure, or replace vendor guidance.

Get watched-vendor alerts Subscribe free Back to feed