CVE-2026-33180

Deferred Deferred - Pending Action

HTTP Header Exposure via Redirects in HAPI FHIR Before

Publication date: 2026-03-20

Last updated on: 2026-06-30

Assigner: GitHub, Inc.

Description

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.0, when setting headers in HTTP requests, the internal HTTP client sends headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the Location: response header value. Sending the same set of headers to subsequent hosts is a problem as this header often contains privacy sensitive information or data that could allow others to impersonate the client's request. This issue has been patched in release 6.9.0. No known workarounds are available.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-03-20

Last Modified

2026-06-30

Generated

2026-07-07

AI Q&A

2026-03-21

EPSS Evaluated

2026-07-06

NVD

CVE-2026-33180

Affected Vendors & Products

Vendor	Product	Version / Range
hapi_fhir	hapi_fhir	to 6.9.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-201	The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

Attack-Flow Graph

Executive Summary

The vulnerability in HAPI FHIR occurs when its internal HTTP client sends HTTP headers containing potentially sensitive information to multiple hosts during HTTP redirects. Specifically, before version 6.9.0, when following a 30X redirect response, the client sends the same headers not only to the original host but also to the host specified in the Location header of the redirect response. This can expose privacy-sensitive data or information that could allow others to impersonate the client's request.

Impact Analysis

This vulnerability can lead to the unintended disclosure of privacy-sensitive information or authentication data to unintended hosts during HTTP redirects. As a result, attackers or unauthorized parties could intercept this information and potentially impersonate the client, leading to privacy breaches or unauthorized access.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate this vulnerability, you should upgrade HAPI FHIR to version 6.9.0 or later, where the issue has been patched.

No known workarounds are available, so applying the update is the recommended immediate step.

Hi! I’m here to help you understand CVE-2026-33180. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70