FHIRPathEngine Regex Backtracking in HAPI FHIR

Mitigation Strategies

To mitigate this vulnerability, you should upgrade HAPI FHIR to version 6.9.10 or later, where the issue has been fixed.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in HAPI FHIR, a Java implementation of the HL7 FHIR standard for healthcare interoperability. Before version 6.9.10, a previous fix for another vulnerability (CVE-2026-45367) did not fully patch the DSTU2 module. Specifically, the method FHIRPathEngine.matches() called the raw String.matches(sw) function without protection against regex timeout, while a related method replaceMatches() was updated. This flaw allows an unauthenticated attacker to exploit catastrophic regex backtracking, which can exhaust the server's CPU resources.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can be exploited by an unauthenticated attacker to cause catastrophic regex backtracking, leading to excessive CPU consumption on the server running HAPI FHIR. This results in a denial of service (DoS) condition, where legitimate users may experience degraded performance or unavailability of the affected service.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves catastrophic regex backtracking in the DSTU2 module of HAPI FHIR prior to version 6.9.10, which can be triggered by unauthenticated attackers sending crafted FHIRPath expressions. Detection involves monitoring for unusually high CPU usage or service disruptions on systems running vulnerable versions of the org.hl7.fhir.dstu2 module.

To detect exploitation attempts, you can monitor logs or network traffic for requests to FHIR Validator HTTP endpoints or FHIR servers that apply FHIRPath invariants, especially those containing complex or suspicious FHIRPath expressions.

There are no specific commands provided in the resources, but general approaches include:

• Use system monitoring tools (e.g., top, htop) to observe CPU spikes correlated with incoming FHIRPath requests.
• Capture and analyze HTTP request logs for unusually complex or repetitive regex patterns in FHIRPath expressions.
• Use network monitoring tools (e.g., tcpdump, Wireshark) to filter and inspect traffic to FHIR endpoints for suspicious payloads.

Since the vulnerability is related to the use of raw String.matches() without timeout protection, detecting regex evaluation timeouts or exceptions in application logs may also help identify attempted exploits.

Useful 0 Not Useful 0