CVE-2026-55471: HAPI FHIR XXE Vulnerability

CVE-2026-55471 Overview

CVE-2026-55471 is an XML External Entity (XXE) injection vulnerability in HAPI FHIR, the reference Java implementation of the HL7 FHIR standard for healthcare interoperability. The flaw resides in org.hl7.fhir.utilities.XsltUtilities, where saxonTransform(...) overloads instantiated a bare net.sf.saxon.TransformerFactoryImpl() without applying ACCESS_EXTERNAL_DTD or ACCESS_EXTERNAL_STYLESHEET restrictions. An attacker who controls or tampers with XML passed through the transformer can trigger local file disclosure, blind XXE, or Server-Side Request Forgery (SSRF) to any URL reachable from the host. The issue is fixed in version 6.9.10 and is tracked under [CWE-611].

Critical Impact
Attackers can read local files and coerce healthcare interoperability servers into making outbound requests to internal systems through crafted XML transformations.

Affected Products

HAPI FHIR org.hl7.fhir.core prior to 6.9.10
Applications using org.hl7.fhir.utilities.XsltUtilities.saxonTransform(...)
FHIR interoperability services processing untrusted XML or XSLT input

Discovery Timeline

2026-07-08 - CVE-2026-55471 published to NVD
2026-07-09 - Last updated in NVD database

Technical Details for CVE-2026-55471

Vulnerability Analysis

The vulnerable code path is inside XsltUtilities.saxonTransform(...), which constructs a Saxon TransformerFactory directly and hands it XML input for transformation. Because the factory is created without hardening attributes, the underlying parser resolves external DTDs and external stylesheets referenced by the input XML. An attacker who can supply or influence transformed XML documents can embed external entity references that force the parser to fetch arbitrary URIs.

Healthcare systems using HAPI FHIR typically process XML payloads submitted by clients or partner organizations, which places this transformer in a position to handle attacker-influenced content. Exploitation yields confidentiality impact on the host processing the transformation and lateral reachability into any HTTP, FTP, or file-scheme endpoint the JVM can access.

Root Cause

The root cause is missing secure processing configuration on the Saxon TransformerFactoryImpl. The factory did not set XMLConstants.ACCESS_EXTERNAL_DTD or XMLConstants.ACCESS_EXTERNAL_STYLESHEET to empty strings, leaving Java's default XXE-permissive behavior in place. Any XML containing a <!DOCTYPE> block with SYSTEM or PUBLIC external identifiers would be resolved during transformation.

Attack Vector

Exploitation requires the attacker to control XML content processed by saxonTransform. Because HAPI FHIR is deployed as a network-facing interoperability layer, malicious XML can typically be delivered through FHIR resource submissions, bundle uploads, or XSLT input channels without authentication. The following patch diff shows how the vulnerable factory instantiation was replaced with a hardened wrapper:

java

 public class XsltUtilities {

   public static byte[] saxonTransform(Map<String, byte[]> files, byte[] source, byte[] xslt) throws TransformerException {
-    TransformerFactory f = new net.sf.saxon.TransformerFactoryImpl();
+    TransformerFactory f = org.hl7.fhir.utilities.xml.XMLUtil.newXXEProtectedSaxonTransformerFactory();
     f.setAttribute("http://saxon.sf.net/feature/version-warning", Boolean.FALSE);
     StreamSource xsrc = new StreamSource(new ByteArrayInputStream(xslt));
     f.setURIResolver(new ZipURIResolver(files));

Source: HAPI FHIR patch commit 01ca2ec

A companion checkstyle rule was added to prevent regressions by blocking direct TransformerFactoryImpl instantiation outside XsltUtilities:

text

+    <module name="RegexpMultiline">
+        <property name="id" value="transformerFactoryImplInstantiation"/>
+        <property name="matchAcrossLines" value="true"/>
+        <property name="format" value="new\s+[\w.]*TransformerFactoryImpl\("/>
+        <property name="message"
+                  value="Instantiation of TransformerFactoryImpl is only allowed in XsltUtilities..."
+        />
+    </module>

Source: HAPI FHIR checkstyle rule

Detection Methods for CVE-2026-55471

Indicators of Compromise

Inbound FHIR XML payloads containing <!DOCTYPE> declarations with SYSTEM or PUBLIC external identifiers
Outbound HTTP, FTP, or file:// requests originating from the HAPI FHIR JVM process to unexpected destinations
DNS lookups from FHIR servers targeting attacker-controlled domains referenced in XML entities
Unexpected reads of sensitive local files such as /etc/passwd, application configuration, or credential stores by the FHIR service account

Detection Strategies

Inspect FHIR ingestion logs for XML documents containing DOCTYPE declarations or external entity references
Correlate FHIR request timestamps with anomalous outbound network flows from the same host
Monitor JVM file access patterns for the HAPI FHIR process using host-based auditing (auditd, Sysmon)
Alert on Saxon transformer errors referencing external resource resolution failures in application logs

Monitoring Recommendations

Enable egress filtering telemetry on hosts running HAPI FHIR and log all outbound connections
Ingest application logs into a centralized data lake for cross-correlation with network events
Track the version of org.hl7.fhir.core deployed across environments using Software Bill of Materials (SBOM) tooling

How to Mitigate CVE-2026-55471

Immediate Actions Required

Upgrade org.hl7.fhir.core to version 6.9.10 or later across all HAPI FHIR deployments
Audit application code for any direct calls to XsltUtilities.saxonTransform(...) on untrusted input
Restrict egress traffic from FHIR servers to only required partner endpoints using network segmentation
Review recent FHIR ingestion logs for XML payloads containing external entity declarations

Patch Information

The fix is released in HAPI FHIR 6.9.10 and replaces the bare TransformerFactoryImpl with the hardened XMLUtil.newXXEProtectedSaxonTransformerFactory() helper. Full technical details are available in GitHub Security Advisory GHSA-2f55-g35j-5jmf.

Workarounds

If upgrading is not immediately possible, wrap calls to saxonTransform with pre-parsing that strips DOCTYPE declarations from incoming XML
Configure a TransformerFactory with ACCESS_EXTERNAL_DTD and ACCESS_EXTERNAL_STYLESHEET set to empty strings before invoking transformations
Deploy a web application firewall rule that rejects FHIR XML payloads containing <!DOCTYPE or <!ENTITY tokens

bash

# Update Maven dependency to the patched version
mvn versions:use-dep-version \
  -Dincludes=ca.uhn.hapi.fhir:org.hl7.fhir.core \
  -DdepVersion=6.9.10 \
  -DforceVersion=true