HAPIFHIR is a narrowly scoped healthcare software vendor focused on FHIR (Fast Healthcare Interoperability Resources) implementations, with exposure concentrated in its HL7 FHIR Core library and related test utilities. Vulnerabilities affecting this vendor skew strongly toward critical-severity outcomes and recur through web-facing and data-access weakness classes including path traversal, improper access controls, cross-site scripting, server-side request forgery, and origin validation errors—patterns common to healthcare integration middleware that handles sensitive patient data and interoperates across trust boundaries. Defenders working with FHIR-based health information systems should prioritize this vendor's security updates and validate configurations to restrict data exposure; live severity and exploitation counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Hapifhir over time
Signals from CVEs in this vendor scope (8 CVEs).
8 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-55471CRITICAL HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.10, org.hl7.fhir.utilities.XsltUtilities saxonTransform(...) o | Jul 8, 2026 | 9.1 | 37 | NO | NO |
CVE-2026-34361CRITICAL HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.4, the FHIR Validator HTTP service exposes an unauthen | Mar 31, 2026 | 9.3 | 34 | NO | NO |
CVE-2026-55470HIGH HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.10, the fix for CVE-2026-45367 incompletely patched the DSTU2 | Jul 8, 2026 | 7.5 | 32 | NO | NO |
CVE-2026-34359CRITICAL HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.4, ManagedWebAccessUtils.getServer() uses String.start | Mar 31, 2026 | 9.1 | 30 | NO | NO |
CVE-2023-24057HIGH HL7 (Health Level 7) FHIR Core Libraries before 5.6.92 allow attackers to extract files into arbitrary directories via directory traversal from a crafted ZIP or TGZ archive (for a | Jan 26, 2023 | 8.1 | 26 | NO | NO |
CVE-2026-34360MEDIUM HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.4, the /loadIG HTTP endpoint in the FHIR Validator HTT | Mar 31, 2026 | 5.8 | 21 | NO | NO |
CVE-2023-28465HIGH The package-decompression feature in HL7 (Health Level 7) FHIR Core Libraries before 5.6.106 allows attackers to copy arbitrary files to certain directories via directory traversal | Dec 12, 2023 | 7.5 | 19 | NO | NO |
CVE-2020-24301MEDIUM Users of the HAPI FHIR Testpage Overlay 5.0.0 and below can use a specially crafted URL to exploit an XSS vulnerability in this module, allowing arbitrary JavaScript to be executed | Oct 8, 2020 | 6.1 | 17 | NO | NO |
Signals from CVEs in this vendor scope (8 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Hapifhir.
Media articles that mention a CVE ID that affects a product developed by Hapifhir — matched by CVE ID, not by vendor name.