ca.uhn.hapi.fhir:org.hl7.fhir.utilities 6.8.2

Direct Vulnerabilities

Known vulnerabilities in the ca.uhn.hapi.fhir:org.hl7.fhir.utilities package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H XML External Entity (XXE) Injection Affected versions of this package are vulnerable to XML External Entity (XXE) Injection through the `saxonTransform()` function that uses unhardened `net.sf.saxon.TransformerFactoryImpl()` method. An attacker can access sensitive local files or trigger arbitrary HTTP(S) requests from the host by supplying crafted XML input containing external entities. How to fix XML External Entity (XXE) Injection? Upgrade `ca.uhn.hapi.fhir:org.hl7.fhir.utilities` to version 6.9.10 or higher.	[,6.9.10)
H Regular Expression Denial of Service (ReDoS) Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the `matches()`, `matchesFull()`, and `replaceMatches()` functions in the FHIRPathEngine. An attacker can exhaust system resources and cause service disruption by submitting specially crafted regular expressions that trigger excessive backtracking during evaluation. How to fix Regular Expression Denial of Service (ReDoS)? Upgrade `ca.uhn.hapi.fhir:org.hl7.fhir.utilities` to version 6.9.7 or higher.	[,6.9.7)
H Insufficiently Protected Credentials Affected versions of this package are vulnerable to Insufficiently Protected Credentials through and exposed `/loadIG` endpoint in `ca.uhn.hapi.fhir:org.hl7.fhir.validation`. An attacker can obtain authentication credentials for external FHIR servers by submitting a crafted URL that exploits improper prefix matching in credential handling, causing sensitive tokens to be sent to attacker-controlled domains. This can also be triggered through redirect chains that re-evaluate credential attachment on each hop. Note: While the entry point for this vulnerability is in ca.uhn.hapi.fhir:org.hl7.fhir.validation, it leverages an exploit chain in ca.uhn.hapi.fhir:org.hl7.fhir.utilities CVE-2026-34359 to expose the credentials How to fix Insufficiently Protected Credentials? Upgrade `ca.uhn.hapi.fhir:org.hl7.fhir.utilities` to version 6.9.4 or higher.	[6.8.0,6.9.4)
H Origin Validation Error Affected versions of this package are vulnerable to Origin Validation Error in the `ManagedWebAccessUtils.getServer` function. An attacker can obtain authentication credentials by leveraging improper URL prefix matching during HTTP redirects, causing sensitive headers such as Bearer tokens, Basic auth credentials, or API keys to be sent to attacker-controlled domains. This can be exploited when the HTTP client follows redirects to URLs that maliciously match the configured server prefix without proper host boundary validation. Note: A partial fix was implemented in version 6.9.3, with a more complete solution implemented when addressing isLocal in 6.9.4 How to fix Origin Validation Error? Upgrade `ca.uhn.hapi.fhir:org.hl7.fhir.utilities` to version 6.9.4 or higher.	[6.4.1,6.9.4)
M Server-side Request Forgery (SSRF) Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the `/loadIG` endpoint, which accepts user-supplied URLs and makes server-side HTTP requests without proper validation of hostnames, schemes, or domains. An attacker can probe internal network services, access cloud metadata endpoints, and map internal network topology by submitting crafted URLs, leveraging error-based information leakage to differentiate between open and closed ports or reachable and unreachable hosts. Redirects are followed without re-validation, allowing bypass of domain restrictions. How to fix Server-side Request Forgery (SSRF)? Upgrade `ca.uhn.hapi.fhir:org.hl7.fhir.utilities` to version 6.9.4 or higher.	[,6.9.4)
H Improper Removal of Sensitive Information Before Storage or Transfer Affected versions of this package are vulnerable to Improper Removal of Sensitive Information Before Storage or Transfer in `HTTPResult()` in `SimpleHTTPClient.java`, when following redirects. An attacker can obtain the contents of "Location: response" headers included in client redirects. How to fix Improper Removal of Sensitive Information Before Storage or Transfer? Upgrade `ca.uhn.hapi.fhir:org.hl7.fhir.utilities` to version 6.9.0 or higher.	[,6.9.0)

Vulnerability

Vulnerable Version

XML External Entity (XXE) Injection

Affected versions of this package are vulnerable to XML External Entity (XXE) Injection through the saxonTransform() function that uses unhardened net.sf.saxon.TransformerFactoryImpl() method. An attacker can access sensitive local files or trigger arbitrary HTTP(S) requests from the host by supplying crafted XML input containing external entities.

How to fix XML External Entity (XXE) Injection?

Upgrade ca.uhn.hapi.fhir:org.hl7.fhir.utilities to version 6.9.10 or higher.

[,6.9.10)

Regular Expression Denial of Service (ReDoS)

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the matches(), matchesFull(), and replaceMatches() functions in the FHIRPathEngine. An attacker can exhaust system resources and cause service disruption by submitting specially crafted regular expressions that trigger excessive backtracking during evaluation.

How to fix Regular Expression Denial of Service (ReDoS)?

Upgrade ca.uhn.hapi.fhir:org.hl7.fhir.utilities to version 6.9.7 or higher.

[,6.9.7)

Insufficiently Protected Credentials

Affected versions of this package are vulnerable to Insufficiently Protected Credentials through and exposed /loadIG endpoint in ca.uhn.hapi.fhir:org.hl7.fhir.validation. An attacker can obtain authentication credentials for external FHIR servers by submitting a crafted URL that exploits improper prefix matching in credential handling, causing sensitive tokens to be sent to attacker-controlled domains. This can also be triggered through redirect chains that re-evaluate credential attachment on each hop.

Note: While the entry point for this vulnerability is in ca.uhn.hapi.fhir:org.hl7.fhir.validation, it leverages an exploit chain in ca.uhn.hapi.fhir:org.hl7.fhir.utilities CVE-2026-34359 to expose the credentials

How to fix Insufficiently Protected Credentials?

Upgrade ca.uhn.hapi.fhir:org.hl7.fhir.utilities to version 6.9.4 or higher.

[6.8.0,6.9.4)

Origin Validation Error

Affected versions of this package are vulnerable to Origin Validation Error in the ManagedWebAccessUtils.getServer function. An attacker can obtain authentication credentials by leveraging improper URL prefix matching during HTTP redirects, causing sensitive headers such as Bearer tokens, Basic auth credentials, or API keys to be sent to attacker-controlled domains. This can be exploited when the HTTP client follows redirects to URLs that maliciously match the configured server prefix without proper host boundary validation.

Note: A partial fix was implemented in version 6.9.3, with a more complete solution implemented when addressing isLocal in 6.9.4

How to fix Origin Validation Error?

Upgrade ca.uhn.hapi.fhir:org.hl7.fhir.utilities to version 6.9.4 or higher.

[6.4.1,6.9.4)

Server-side Request Forgery (SSRF)

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the /loadIG endpoint, which accepts user-supplied URLs and makes server-side HTTP requests without proper validation of hostnames, schemes, or domains. An attacker can probe internal network services, access cloud metadata endpoints, and map internal network topology by submitting crafted URLs, leveraging error-based information leakage to differentiate between open and closed ports or reachable and unreachable hosts. Redirects are followed without re-validation, allowing bypass of domain restrictions.

How to fix Server-side Request Forgery (SSRF)?

Upgrade ca.uhn.hapi.fhir:org.hl7.fhir.utilities to version 6.9.4 or higher.

[,6.9.4)

Improper Removal of Sensitive Information Before Storage or Transfer

Affected versions of this package are vulnerable to Improper Removal of Sensitive Information Before Storage or Transfer in HTTPResult() in SimpleHTTPClient.java, when following redirects. An attacker can obtain the contents of "Location: response" headers included in client redirects.

How to fix Improper Removal of Sensitive Information Before Storage or Transfer?

Upgrade ca.uhn.hapi.fhir:org.hl7.fhir.utilities to version 6.9.0 or higher.

[,6.9.0)

ca.uhn.hapi.fhir:org.hl7.fhir.utilities@6.8.2

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically