# Summary All implementations of FHIRPathEngine accept arbitrary FHIRPath expressions and evaluate them without input validation. The utility intended to secure this evaluation did so incorrectly, and did not fully cover all places in which evaluation was being done. An attacker can send a resource containing an evil regex pattern that causes catastrophic backtracking, exhausting system resources, and causing Denial-of-Service. ## Details The vulnerability exists in regex execution in FHIRPathEngine implementations across multiple code modules. The FHIRPath functions matches(), matchesFull(), and replaceMatches() pass user-controlled regular expressions to Java's Pattern.compile() and String.replaceAll() through a utility class designed to time out after a specified interval. That utility correctly cancelled a single executor thread and returned with an exception, but the execution within the thread had no means to listen for this cancellation and would persist. Furthermore, three modules contained method calls in FHIRPathEngine that were not protected by this utility class. ## Why this is exploitable: Java's Pattern.compile() with a pattern like (a+)+$ against input "aaaaaaaaaaaaaaaaaaaaaa!" causes exponential backtracking (O(2^n) time complexity). ## Impact CPU Exhaustion: The exponential backtracking in Java's regex engine consumes 100% of a CPU core for the duration of the hang (effectively infinite for sufficiently long input strings) for callers of FHIRPathEngine.
# Summary All implementations of FHIRPathEngine accept arbitrary FHIRPath expressions and evaluate them without input validation. The utility intended to secure this evaluation did so incorrectly, and did not fully cover all places in which evaluation was being done. An attacker can send a resource containing an evil regex pattern that causes catastrophic backtracking, exhausting system resources, and causing Denial-of-Service. ## Details The vulnerability exists in regex execution in FHIRPathEngine implementations across multiple code modules. The FHIRPath functions matches(), matchesFull(), and replaceMatches() pass user-controlled regular expressions to Java's Pattern.compile() and String.replaceAll() through a utility class designed to time out after a specified interval. That utility correctly cancelled a single executor thread and returned with an exception, but the execution within the thread had no means to listen for this cancellation and would persist. Furthermore, three modules contained method calls in FHIRPathEngine that were not protected by this utility class. ## Why this is exploitable: Java's Pattern.compile() with a pattern like (a+)+$ against input "aaaaaaaaaaaaaaaaaaaaaa!" causes exponential backtracking (O(2^n) time complexity). ## Impact CPU Exhaustion: The exponential backtracking in Java's regex engine consumes 100% of a CPU core for the duration of the hang (effectively infinite for sufficiently long input strings) for callers of FHIRPathEngine.
Update ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 to 6.9.9; ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 to 6.9.4.2; ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may to 6.9.9; ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may to 6.9.4.2; ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 to 6.9.9; ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 to 6.9.4.2; ca.uhn.hapi.fhir:org.hl7.fhir.r4 to 6.9.9; ca.uhn.hapi.fhir:org.hl7.fhir.r4 to 6.9.4.2; ca.uhn.hapi.fhir:org.hl7.fhir.r4b to 6.9.9; ca.uhn.hapi.fhir:org.hl7.fhir.r4b to 6.9.4.2; ca.uhn.hapi.fhir:org.hl7.fhir.r5 to 6.9.9; ca.uhn.hapi.fhir:org.hl7.fhir.r5 to 6.9.4.2; ca.uhn.hapi.fhir:org.hl7.fhir.validation to 6.9.9; ca.uhn.hapi.fhir:org.hl7.fhir.validation to 6.9.4.2; ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli to 6.9.9; ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli to 6.9.4.2 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanorg.hl7.fhir.core: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint affects ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (maven), ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (maven), ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may (maven), ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may (maven), ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 (maven), ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 (maven), ca.uhn.hapi.fhir:org.hl7.fhir.r4 (maven), ca.uhn.hapi.fhir:org.hl7.fhir.r4 (maven), ca.uhn.hapi.fhir:org.hl7.fhir.r4b (maven), ca.uhn.hapi.fhir:org.hl7.fhir.r4b (maven), ca.uhn.hapi.fhir:org.hl7.fhir.r5 (maven), ca.uhn.hapi.fhir:org.hl7.fhir.r5 (maven), ca.uhn.hapi.fhir:org.hl7.fhir.validation (maven), ca.uhn.hapi.fhir:org.hl7.fhir.validation (maven), ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli (maven), ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli (maven). Severity is high. # Summary All implementations of FHIRPathEngine accept arbitrary FHIRPath expressions and evaluate them without input validation. The utility intended to secure this evaluation did so incorrectly, and did not fully cover all places in which evaluation was being done. An attacker can send a resource containing an evil regex pattern that causes catastrophic backtracking, exhausting system resources, and causing Denial-of-Service. ## Details The vulnerability exists in regex execution in FHIRPathEngine implementations across multiple code modules. The FHIRPath functions matches(), matchesFull(), and replaceMatches() pass user-controlled regular expressions to Java's Pattern.compile() and String.replaceAll() through a utility class designed to time out after a specified interval. That utility correctly cancelled a single executor thread and returned with an exception, but the execution within the thread had no means to listen for this cancellation and would persist. Furthermore, three modules contained method calls in FHIRPathEngine that were not protected by this utility class. ## Why this is exploitable: Java's Pattern.compile() with a pattern like (a+)+$ against input "aaaaaaaaaaaaaaaaaaaaaa!" causes exponential backtracking (O(2^n) time complexity). ## Impact CPU Exhaustion: The exponential backtracking in Java's regex engine consumes 100% of a CPU core for the duration of the hang (effectively infinite for sufficiently long input strings) for callers of FHIRPathEngine.
AI coding agents often install or upgrade packages automatically in maven. A high vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| ca.uhn.hapi.fhir:org.hl7.fhir.dstu2maven | >=6.9.5,<6.9.9 | 6.9.9 |
| ca.uhn.hapi.fhir:org.hl7.fhir.dstu2maven | <6.9.4.2 | 6.9.4.2 |
| ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016maymaven | >=6.9.5,<6.9.9 | 6.9.9 |
| ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016maymaven | <6.9.4.2 | 6.9.4.2 |
| ca.uhn.hapi.fhir:org.hl7.fhir.dstu3maven | >=6.9.5,<6.9.9 | 6.9.9 |
| ca.uhn.hapi.fhir:org.hl7.fhir.dstu3maven | <6.9.4.2 | 6.9.4.2 |
| ca.uhn.hapi.fhir:org.hl7.fhir.r4 |
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL GuardUpdate ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 to 6.9.9; ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 to 6.9.4.2; ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may to 6.9.9; ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may to 6.9.4.2; ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 to 6.9.9; ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 to 6.9.4.2; ca.uhn.hapi.fhir:org.hl7.fhir.r4 to 6.9.9; ca.uhn.hapi.fhir:org.hl7.fhir.r4 to 6.9.4.2; ca.uhn.hapi.fhir:org.hl7.fhir.r4b to 6.9.9; ca.uhn.hapi.fhir:org.hl7.fhir.r4b to 6.9.4.2; ca.uhn.hapi.fhir:org.hl7.fhir.r5 to 6.9.9; ca.uhn.hapi.fhir:org.hl7.fhir.r5 to 6.9.4.2; ca.uhn.hapi.fhir:org.hl7.fhir.validation to 6.9.9; ca.uhn.hapi.fhir:org.hl7.fhir.validation to 6.9.4.2; ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli to 6.9.9; ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli to 6.9.4.2 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanorg.hl7.fhir.core: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint affects ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (maven), ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (maven), ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may (maven), ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may (maven), ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 (maven), ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 (maven), ca.uhn.hapi.fhir:org.hl7.fhir.r4 (maven), ca.uhn.hapi.fhir:org.hl7.fhir.r4 (maven), ca.uhn.hapi.fhir:org.hl7.fhir.r4b (maven), ca.uhn.hapi.fhir:org.hl7.fhir.r4b (maven), ca.uhn.hapi.fhir:org.hl7.fhir.r5 (maven), ca.uhn.hapi.fhir:org.hl7.fhir.r5 (maven), ca.uhn.hapi.fhir:org.hl7.fhir.validation (maven), ca.uhn.hapi.fhir:org.hl7.fhir.validation (maven), ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli (maven), ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli (maven). Severity is high. # Summary All implementations of FHIRPathEngine accept arbitrary FHIRPath expressions and evaluate them without input validation. The utility intended to secure this evaluation did so incorrectly, and did not fully cover all places in which evaluation was being done. An attacker can send a resource containing an evil regex pattern that causes catastrophic backtracking, exhausting system resources, and causing Denial-of-Service. ## Details The vulnerability exists in regex execution in FHIRPathEngine implementations across multiple code modules. The FHIRPath functions matches(), matchesFull(), and replaceMatches() pass user-controlled regular expressions to Java's Pattern.compile() and String.replaceAll() through a utility class designed to time out after a specified interval. That utility correctly cancelled a single executor thread and returned with an exception, but the execution within the thread had no means to listen for this cancellation and would persist. Furthermore, three modules contained method calls in FHIRPathEngine that were not protected by this utility class. ## Why this is exploitable: Java's Pattern.compile() with a pattern like (a+)+$ against input "aaaaaaaaaaaaaaaaaaaaaa!" causes exponential backtracking (O(2^n) time complexity). ## Impact CPU Exhaustion: The exponential backtracking in Java's regex engine consumes 100% of a CPU core for the duration of the hang (effectively infinite for sufficiently long input strings) for callers of FHIRPathEngine.
AI coding agents often install or upgrade packages automatically in maven. A high vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| ca.uhn.hapi.fhir:org.hl7.fhir.dstu2maven | >=6.9.5,<6.9.9 | 6.9.9 |
| ca.uhn.hapi.fhir:org.hl7.fhir.dstu2maven | <6.9.4.2 | 6.9.4.2 |
| ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016maymaven | >=6.9.5,<6.9.9 | 6.9.9 |
| ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016maymaven | <6.9.4.2 | 6.9.4.2 |
| ca.uhn.hapi.fhir:org.hl7.fhir.dstu3maven | >=6.9.5,<6.9.9 | 6.9.9 |
| ca.uhn.hapi.fhir:org.hl7.fhir.dstu3maven | <6.9.4.2 | 6.9.4.2 |
| ca.uhn.hapi.fhir:org.hl7.fhir.r4 |
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard| >=6.9.5,<6.9.9 |
| 6.9.9 |
| ca.uhn.hapi.fhir:org.hl7.fhir.r4maven | <6.9.4.2 | 6.9.4.2 |
|---|
| ca.uhn.hapi.fhir:org.hl7.fhir.r4bmaven | >=6.9.5,<6.9.9 | 6.9.9 |
|---|
| ca.uhn.hapi.fhir:org.hl7.fhir.r4bmaven | <6.9.4.2 | 6.9.4.2 |
|---|
| ca.uhn.hapi.fhir:org.hl7.fhir.r5maven | >=6.9.5,<6.9.9 | 6.9.9 |
|---|
| ca.uhn.hapi.fhir:org.hl7.fhir.r5maven | <6.9.4.2 | 6.9.4.2 |
|---|
| ca.uhn.hapi.fhir:org.hl7.fhir.validationmaven | >=6.9.5,<6.9.9 | 6.9.9 |
|---|
| ca.uhn.hapi.fhir:org.hl7.fhir.validationmaven | <6.9.4.2 | 6.9.4.2 |
|---|
| ca.uhn.hapi.fhir:org.hl7.fhir.validation.climaven | >=6.9.5,<6.9.9 | 6.9.9 |
|---|
| ca.uhn.hapi.fhir:org.hl7.fhir.validation.climaven | <6.9.4.2 | 6.9.4.2 |
|---|
Fixed versions are reported by the source feed; confirm compatibility before updating.
| >=6.9.5,<6.9.9 |
| 6.9.9 |
| ca.uhn.hapi.fhir:org.hl7.fhir.r4maven | <6.9.4.2 | 6.9.4.2 |
|---|
| ca.uhn.hapi.fhir:org.hl7.fhir.r4bmaven | >=6.9.5,<6.9.9 | 6.9.9 |
|---|
| ca.uhn.hapi.fhir:org.hl7.fhir.r4bmaven | <6.9.4.2 | 6.9.4.2 |
|---|
| ca.uhn.hapi.fhir:org.hl7.fhir.r5maven | >=6.9.5,<6.9.9 | 6.9.9 |
|---|
| ca.uhn.hapi.fhir:org.hl7.fhir.r5maven | <6.9.4.2 | 6.9.4.2 |
|---|
| ca.uhn.hapi.fhir:org.hl7.fhir.validationmaven | >=6.9.5,<6.9.9 | 6.9.9 |
|---|
| ca.uhn.hapi.fhir:org.hl7.fhir.validationmaven | <6.9.4.2 | 6.9.4.2 |
|---|
| ca.uhn.hapi.fhir:org.hl7.fhir.validation.climaven | >=6.9.5,<6.9.9 | 6.9.9 |
|---|
| ca.uhn.hapi.fhir:org.hl7.fhir.validation.climaven | <6.9.4.2 | 6.9.4.2 |
|---|
Fixed versions are reported by the source feed; confirm compatibility before updating.