CVE-2026-33180
Received Received - Intake
HTTP Header Exposure via Redirects in HAPI FHIR Before

Publication date: 2026-03-20

Last updated on: 2026-03-20

Assigner: GitHub, Inc.

Description
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.0, when setting headers in HTTP requests, the internal HTTP client sends headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the Location: response header value. Sending the same set of headers to subsequent hosts is a problem as this header often contains privacy sensitive information or data that could allow others to impersonate the client's request. This issue has been patched in release 6.9.0. No known workarounds are available.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-20
Last Modified
2026-03-20
Generated
2026-06-16
AI Q&A
2026-03-21
EPSS Evaluated
2026-06-15
NVD
CVE-2026-33180
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
hapi_fhir hapi_fhir to 6.9.0 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

The vulnerability in HAPI FHIR occurs when its internal HTTP client sends HTTP headers containing potentially sensitive information to multiple hosts during HTTP redirects. Specifically, before version 6.9.0, when following a 30X redirect response, the client sends the same headers not only to the original host but also to the host specified in the Location header of the redirect response. This can expose privacy-sensitive data or information that could allow others to impersonate the client's request.

Impact Analysis

This vulnerability can lead to the unintended disclosure of privacy-sensitive information or authentication data to unintended hosts during HTTP redirects. As a result, attackers or unauthorized parties could intercept this information and potentially impersonate the client, leading to privacy breaches or unauthorized access.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate this vulnerability, you should upgrade HAPI FHIR to version 6.9.0 or later, where the issue has been patched.

No known workarounds are available, so applying the update is the recommended immediate step.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-33180. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart