CVE-2026-49485: HAPI FHIR DOS Vulnerability

CVE-2026-49485 Overview

CVE-2026-49485 is a denial-of-service vulnerability in HAPI FHIR, a Java implementation of the HL7 FHIR standard for healthcare interoperability. The FHIRPathEngine accepts arbitrary FHIRPath expressions without input validation. The matches(), matchesFull(), and replaceMatches() functions pass user-controlled regular expressions to Java's Pattern.compile() and String.replaceAll() through an incomplete timeout utility. Attackers can submit resources containing catastrophic-backtracking regex patterns to exhaust CPU resources on the FHIR Validator HTTP endpoint and affected org.hl7.fhir.* modules. The issue is tracked under [CWE-400] Uncontrolled Resource Consumption and fixed in versions 6.9.9 and 6.9.4.2.

Critical Impact
Unauthenticated remote attackers can trigger sustained CPU exhaustion on FHIR validation endpoints, disrupting healthcare interoperability services.

Affected Products

HAPI FHIR / org.hl7.fhir.core versions prior to 6.9.9
HAPI FHIR / org.hl7.fhir.core versions prior to 6.9.4.2 (6.9.4.x branch)
FHIR Validator HTTP endpoint and affected org.hl7.fhir.r4, org.hl7.fhir.r4b, and org.hl7.fhir.r5 modules

Discovery Timeline

2026-07-17 - CVE-2026-49485 published to the National Vulnerability Database
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-49485

Vulnerability Analysis

The vulnerability is a Regular Expression Denial of Service (ReDoS) in the FHIRPath expression evaluator. HAPI FHIR exposes FHIRPath as a query and validation language for FHIR resources. The engine evaluates FHIRPath expressions supplied within resource payloads, including expressions that invoke matches(), matchesFull(), and replaceMatches().

These functions forward user-supplied regex patterns directly to Pattern.compile() and String.replaceAll(). The existing timeout utility did not cover all code paths, leaving funcReplaceMatches and related functions unbounded. A crafted regex triggers catastrophic backtracking in the Java regex engine, blocking the executing thread and consuming CPU until the request is cancelled.

Root Cause

The root cause is missing enforcement of execution time limits on regex operations invoked from FHIRPath. The pre-patch FHIRPathEngine invoked convertToString(focus.get(0)).replaceAll(regex, repl) without wrapping the call in the RegexTimeout helper. Combined with the absence of input validation on FHIRPath expressions themselves, any client able to submit a FHIR resource for validation can influence regex evaluation.

Attack Vector

Exploitation is network-based, requires no authentication, and needs no user interaction. An attacker POSTs a FHIR resource that embeds a FHIRPath expression using replaceMatches() or matches() with an evil regex such as (a+)+$ against a long input. The validator thread stalls in String.replaceAll, exhausting a worker. Repeated requests exhaust the thread pool and produce a denial of service on the FHIR Validator HTTP endpoint.

java

// Security patch: org.hl7.fhir.r4/src/main/java/org/hl7/fhir/r4/fhirpath/FHIRPathEngine.java
// Wraps replaceAll in RegexTimeout to prevent catastrophic backtracking
    String repl = convertToString(replB);

    if (focus.size() == 0 || regexB.size() == 0 || replB.size() == 0) {
      // no-op
    } else if (focus.size() == 1 && !Utilities.noString(regex)) {
      if (focus.get(0).hasType(FHIR_TYPES_STRING) || doImplicitStringConversion) {
        try {
          String replaced = RegexTimeout.replaceAll(convertToString(focus.get(0)), regex, repl);
          result.add(new StringType(replaced).noExtensions());
        } catch (TimeoutException te) {
          throw new FHIRException("Timeout evaluating regex: " + regex, te);
        }
      }
    } else {
      result.add(new StringType(convertToString(focus.get(0))).noExtensions());
// Source: https://github.com/hapifhir/org.hl7.fhir.core/commit/109c88837c032ef399b2eb87ddde86692065cf41

Detection Methods for CVE-2026-49485

Indicators of Compromise

Sustained high CPU utilization on JVM threads executing java.util.regex.Pattern$* or String.replaceAll frames within FHIRPathEngine.
HTTP requests to /fhir validator endpoints containing FHIRPath expressions with nested quantifiers such as (a+)+, (.*a){n}, or (a|a?)+.
Application logs showing FHIRException: Timeout evaluating regex entries after the patch is applied.

Detection Strategies

Instrument the JVM to capture thread dumps when CPU usage exceeds a threshold, then correlate stalled threads with FHIRPathEngine and funcReplaceMatches frames.
Inspect FHIR request payloads at the reverse proxy or WAF for matches(, matchesFull(, and replaceMatches( tokens combined with suspicious quantifier patterns.
Track request duration and thread-pool saturation on FHIR Validator endpoints and alert when p99 latency spikes without corresponding traffic increases.

Monitoring Recommendations

Enable request-level timing and payload-size logging on all HAPI FHIR endpoints exposed to untrusted clients.
Forward JVM metrics (cpu.usage, thread.states, GC pauses) and application logs to a centralized log platform for anomaly correlation.
Configure alerts for repeated TimeoutException events from RegexTimeout after upgrading, as they indicate active exploitation attempts.

How to Mitigate CVE-2026-49485

Immediate Actions Required

Upgrade org.hl7.fhir.core to version 6.9.9, or to 6.9.4.2 if pinned to the 6.9.4.x line, as described in the GitHub Security Advisory GHSA-7cmj-v6x8-frvv.
Audit all deployments that expose the FHIR Validator HTTP endpoint to untrusted or internet-facing clients.
Restrict access to validation endpoints to authenticated clients until patching is complete.

Patch Information

The fix is delivered in HAPI FHIR release 6.9.9 and release 6.9.4.2. The patch, tracked in Pull Request #2463 and commits 109c8883 and e08982d2, wraps regex operations in funcReplaceMatches across the r4, r4b, and r5 engines with the RegexTimeout utility so long-running patterns throw a TimeoutException instead of blocking the thread.

Workarounds

Place a WAF or reverse-proxy rule in front of FHIR endpoints to reject payloads containing FHIRPath replaceMatches(, matches(, or matchesFull( tokens from untrusted sources.
Enforce per-request CPU and wall-clock timeouts at the servlet container or application-gateway layer to bound worst-case regex evaluation.
Rate-limit unauthenticated requests to /fhir/$validate and related validator paths.

bash

# Example Maven dependency update to pull in the fixed HAPI FHIR core release
mvn versions:use-dep-version \
  -Dincludes=org.hl7.fhir:org.hl7.fhir.r4,org.hl7.fhir:org.hl7.fhir.r4b,org.hl7.fhir:org.hl7.fhir.r5 \
  -DdepVersion=6.9.9 -DforceVersion=true

# Verify the resolved version
mvn dependency:tree | grep -E "org.hl7.fhir\.(r4|r4b|r5)"