CVE-2026-55470: HAPI FHIR DOS Vulnerability

CVE-2026-55470 Overview

CVE-2026-55470 is a Regular Expression Denial of Service (ReDoS) vulnerability in HAPI FHIR, the Java implementation of the HL7 FHIR standard for healthcare interoperability. The flaw exists in the DSTU2 module and stems from an incomplete fix for CVE-2026-45367. The FHIRPathEngine.matches() method in org.hl7.fhir.dstu2/utils/FHIRPathEngine.java calls raw String.matches(sw) without RegexTimeout protection. An unauthenticated attacker can submit a crafted FHIRPath expression that triggers catastrophic regex backtracking and exhausts server CPU resources. The issue is fixed in version 6.9.10.

Critical Impact
Unauthenticated remote attackers can exhaust CPU on healthcare interoperability servers using a single crafted FHIRPath regex, disrupting availability of clinical data services.

Affected Products

HAPI FHIR org.hl7.fhir.core versions prior to 6.9.10
DSTU2 module (org.hl7.fhir.dstu2) FHIRPathEngine component
Java-based healthcare applications embedding vulnerable HAPI FHIR releases

Discovery Timeline

2026-07-08 - CVE-2026-55470 published to NVD
2026-07-09 - Last updated in NVD database

Technical Details for CVE-2026-55470

Vulnerability Analysis

The vulnerability is classified as CWE-1333, Inefficient Regular Expression Complexity. HAPI FHIR exposes the FHIRPath expression language for querying and matching healthcare resources. Within FHIRPath, the matches() function evaluates a regular expression against a target string. In the DSTU2 module, this function delegated directly to the Java standard library's String.matches() method.

A prior patch for CVE-2026-45367 introduced a RegexTimeout wrapper that aborts pathological regex evaluations. That patch updated replaceMatches() but omitted funcMatches(). Attackers who reach a FHIRPath evaluation surface can supply an evil regex pattern that induces catastrophic backtracking. The Java regex engine then consumes a single CPU core until the request completes or the process is terminated.

Root Cause

The root cause is an incomplete remediation. The fix for CVE-2026-45367 applied RegexTimeout to some regex sinks but left funcMatches() in org.hl7.fhir.dstu2/utils/FHIRPathEngine.java calling String.matches(sw) on untrusted input without a timeout guard.

Attack Vector

Exploitation requires no authentication and no user interaction over the network. Any endpoint that evaluates a client-supplied FHIRPath expression against DSTU2 resources exposes the vulnerable code path. Repeated requests amplify CPU exhaustion and degrade service availability for concurrent healthcare consumers.

java

// Security patch in org.hl7.fhir.dstu2/src/main/java/org/hl7/fhir/dstu2/utils/FHIRPathEngine.java
// Fix: Add RegexTimeout to dstu2 funcMatches
  private List<Base> funcMatches(ExecutionContext context, List<Base> focus, ExpressionNode exp)
    throws PathEngineException {
    List<Base> result = new ArrayList<>();
    String regex = convertToString(execute(context, focus, exp.getParameters().get(0), true));

    if (focus.size() == 1 && !Utilities.noString(regex)) {
      try {
        @SuppressWarnings("checkstyle:stringImplicitPatternUsage")
        //False positive: RegexTimeout.replaceAll is safe for user-supplied regular expressions
        final boolean matchResult = RegexTimeout.matches(convertToString(focus.get(0)), regex);
        result.add(new BooleanType(matchResult));
      } catch (TimeoutException e) {
          throw new PathEngineException("Timeout evaluating regex: " + regex, e);
      }
    } else
      result.add(new BooleanType(false));
    return result;

Source: GitHub Commit 56376f7

Detection Methods for CVE-2026-55470

Indicators of Compromise

Sustained single-thread CPU saturation on Java processes hosting HAPI FHIR DSTU2 endpoints
FHIR requests containing FHIRPath expressions with matches() and nested quantifiers such as (a+)+, (a|a)*, or long alternation chains
HTTP requests to /dstu2/* FHIR endpoints followed by response latency spikes or timeouts

Detection Strategies

Inspect application logs for PathEngineException messages referencing regex evaluation
Baseline normal FHIRPath query patterns and alert on payloads containing suspicious quantifier structures
Correlate JVM CPU metrics with inbound FHIR request rates to identify asymmetric resource consumption

Monitoring Recommendations

Enable per-request timing metrics on FHIR endpoints and alert on outliers above defined SLO thresholds
Monitor thread dumps for stack frames in java.util.regex.Pattern$Curly.match or Pattern$GroupHead.match
Track dependency versions of org.hl7.fhir.core via software composition analysis and flag releases prior to 6.9.10

How to Mitigate CVE-2026-55470

Immediate Actions Required

Upgrade org.hl7.fhir.core to version 6.9.10 or later across all services that expose DSTU2 FHIRPath evaluation
Audit deployed applications and container images for transitive dependencies pinned to vulnerable versions
Rate-limit unauthenticated FHIR endpoints to reduce the blast radius of CPU-exhaustion attempts

Patch Information

The fix is available in HAPI FHIR core 6.9.10. See the GitHub Release 6.9.10, the GitHub Security Advisory GHSA-fxj4-p9xp-37v5, and the remediation commit 56376f7. The patch routes funcMatches() through RegexTimeout.matches(), which aborts evaluation and raises PathEngineException when a regex exceeds its time budget.

Workarounds

Place a reverse proxy or Web Application Firewall in front of FHIR endpoints to inspect and block FHIRPath payloads containing high-risk regex constructs
Disable or restrict access to DSTU2 endpoints if the application does not require the legacy standard
Enforce authentication and per-client request quotas on all FHIR API surfaces until the upgrade is deployed

bash

# Update the HAPI FHIR core dependency to the patched release
# Maven
mvn versions:use-dep-version -Dincludes=ca.uhn.hapi.fhir:org.hl7.fhir.core -DdepVersion=6.9.10 -DforceVersion=true

# Gradle
# In build.gradle:
# implementation 'ca.uhn.hapi.fhir:org.hl7.fhir.core:6.9.10'

# Verify the resolved version does not include the vulnerable class path
mvn dependency:tree | grep org.hl7.fhir.core