ca.uhn.hapi.fhir:org.hl7.fhir.r5 5.6.101

Direct Vulnerabilities

Known vulnerabilities in the ca.uhn.hapi.fhir:org.hl7.fhir.r5 package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Regular Expression Denial of Service (ReDoS) Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the `matches`, `matchesFull`, and `replaceMatches` functions in FHIRPath expression evaluation. An attacker can exhaust system CPU resources by submitting specially crafted regular expressions that trigger excessive backtracking during regex processing. How to fix Regular Expression Denial of Service (ReDoS)? Upgrade `ca.uhn.hapi.fhir:org.hl7.fhir.r5` to version 6.9.4.2, 6.9.9 or higher.	[,6.9.4.2)[6.9.5,6.9.9)
H Regular Expression Denial of Service (ReDoS) Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the `matches()`, `matchesFull()`, and `replaceMatches()` functions in the FHIRPathEngine. An attacker can exhaust system resources and cause service disruption by submitting specially crafted regular expressions that trigger excessive backtracking during evaluation. How to fix Regular Expression Denial of Service (ReDoS)? Upgrade `ca.uhn.hapi.fhir:org.hl7.fhir.r5` to version 6.9.7 or higher.	[,6.9.7)
H XML External Entity (XXE) Injection Affected versions of this package are vulnerable to XML External Entity (XXE) Injection via `XSLT` transforms. An attacker can access sensitive information from the host system by processing an XML file with a malicious DTD tag `( ]>`. All cases where `org.hl7.fhir.core` is being used on a host where external clients can submit XML are impacted. Note: This is due to an incomplete fix of CVE-2024-45294. How to fix XML External Entity (XXE) Injection? Upgrade `ca.uhn.hapi.fhir:org.hl7.fhir.r5` to version 6.4.0 or higher.	[,6.4.0)
C XML External Entity (XXE) Injection Affected versions of this package are vulnerable to XML External Entity (XXE) Injection due to allowing external `DOCTYPE` elements in the `DocumentBuilderFactory` class. How to fix XML External Entity (XXE) Injection? Upgrade `ca.uhn.hapi.fhir:org.hl7.fhir.r5` to version 6.4.0 or higher.	[,6.4.0)
H XML External Entity (XXE) Injection Affected versions of this package are vulnerable to XML External Entity (XXE) Injection via `XSLT` transforms. An attacker can access sensitive information from the host system by processing an XML file with a malicious DTD tag. All cases where `org.hl7.fhir.core` is being used on a host where external clients can submit XML are impacted. How to fix XML External Entity (XXE) Injection? Upgrade `ca.uhn.hapi.fhir:org.hl7.fhir.r5` to version 6.3.21 or higher.	[,6.3.21)
H Arbitrary File Write via Archive Extraction (Zip Slip) Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) this is due to a bypass of CVE-2023-24057. This issue allows a malicious actor to potentially break out of the `TerminologyCacheManager` cache directory. The impact is limited to sibling directories. For example, consider `"/usr/outnot".startsWith("/usr/out")`. The check is bypassed although `/outnot` is not under the `/out` directory. How to fix Arbitrary File Write via Archive Extraction (Zip Slip)? Upgrade `ca.uhn.hapi.fhir:org.hl7.fhir.r5` to version 5.6.106 or higher.	[,5.6.106)

Vulnerability

Vulnerable Version

Regular Expression Denial of Service (ReDoS)

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the matches, matchesFull, and replaceMatches functions in FHIRPath expression evaluation. An attacker can exhaust system CPU resources by submitting specially crafted regular expressions that trigger excessive backtracking during regex processing.

How to fix Regular Expression Denial of Service (ReDoS)?

Upgrade ca.uhn.hapi.fhir:org.hl7.fhir.r5 to version 6.9.4.2, 6.9.9 or higher.

[,6.9.4.2)[6.9.5,6.9.9)

Regular Expression Denial of Service (ReDoS)

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the matches(), matchesFull(), and replaceMatches() functions in the FHIRPathEngine. An attacker can exhaust system resources and cause service disruption by submitting specially crafted regular expressions that trigger excessive backtracking during evaluation.

How to fix Regular Expression Denial of Service (ReDoS)?

Upgrade ca.uhn.hapi.fhir:org.hl7.fhir.r5 to version 6.9.7 or higher.

[,6.9.7)

XML External Entity (XXE) Injection

Affected versions of this package are vulnerable to XML External Entity (XXE) Injection via XSLT transforms. An attacker can access sensitive information from the host system by processing an XML file with a malicious DTD tag ( ]>. All cases where org.hl7.fhir.core is being used on a host where external clients can submit XML are impacted.

Note: This is due to an incomplete fix of CVE-2024-45294.

How to fix XML External Entity (XXE) Injection?

Upgrade ca.uhn.hapi.fhir:org.hl7.fhir.r5 to version 6.4.0 or higher.

[,6.4.0)

XML External Entity (XXE) Injection

Affected versions of this package are vulnerable to XML External Entity (XXE) Injection due to allowing external DOCTYPE elements in the DocumentBuilderFactory class.

How to fix XML External Entity (XXE) Injection?

Upgrade ca.uhn.hapi.fhir:org.hl7.fhir.r5 to version 6.4.0 or higher.

[,6.4.0)

XML External Entity (XXE) Injection

Affected versions of this package are vulnerable to XML External Entity (XXE) Injection via XSLT transforms. An attacker can access sensitive information from the host system by processing an XML file with a malicious DTD tag. All cases where org.hl7.fhir.core is being used on a host where external clients can submit XML are impacted.

How to fix XML External Entity (XXE) Injection?

Upgrade ca.uhn.hapi.fhir:org.hl7.fhir.r5 to version 6.3.21 or higher.

[,6.3.21)

Arbitrary File Write via Archive Extraction (Zip Slip)

Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) this is due to a bypass of CVE-2023-24057. This issue allows a malicious actor to potentially break out of the TerminologyCacheManager cache directory. The impact is limited to sibling directories.

For example, consider "/usr/outnot".startsWith("/usr/out"). The check is bypassed although /outnot is not under the /out directory.

How to fix Arbitrary File Write via Archive Extraction (Zip Slip)?

Upgrade ca.uhn.hapi.fhir:org.hl7.fhir.r5 to version 5.6.106 or higher.

[,5.6.106)

ca.uhn.hapi.fhir:org.hl7.fhir.r5@5.6.101

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically