CVE-2026-49485: 
Java Analyse et atténuation des vulnérabilités

CVE-2026-49485 is a Regular Expression Denial-of-Service (ReDoS) vulnerability in the org.hl7.fhir.core library, affecting all FHIRPathEngine implementations across multiple HAPI FHIR Maven packages. The vulnerability allows unauthenticated remote attackers to cause Denial-of-Service by submitting resources containing malicious regex patterns that trigger catastrophic backtracking in Java's regex engine. It was first published on June 1, 2026 by maintainer dotasek and added to the GitHub Advisory Database on July 9, 2026. Affected packages include ca.uhn.hapi.fhir:org.hl7.fhir.dstu2, dstu2016may, dstu3, r4, r4b, r5, validation, and validation.cli, all versions ≤ 6.9.8. The CVSS v3.1 base score is 7.5 (High) (GitHub Advisory, HAPI FHIR Advisory).

The root cause is classified as CWE-400 (Uncontrolled Resource Consumption) and CWE-1333 (Inefficient Regular Expression Complexity). The FHIRPath functions matches(), matchesFull(), and replaceMatches() pass user-controlled regular expressions directly to Java's Pattern.compile() and String.replaceAll() via a utility class intended to enforce a timeout. However, the timeout mechanism only cancelled the executor thread externally — the thread itself had no interrupt-aware logic and continued executing. Additionally, three code modules contained FHIRPathEngine method calls that bypassed this utility class entirely, leaving them completely unprotected. A crafted pattern such as (a+)+$ evaluated against input like "aaaaaaaaaaaaaaaaaaaaaa!" causes O(2^n) exponential backtracking in Java's NFA-based regex engine (GitHub Advisory, HAPI FHIR Advisory).

Successful exploitation results in complete CPU exhaustion on the affected server, consuming 100% of a CPU core for an effectively unbounded duration when sufficiently long input strings are used. This causes a Denial-of-Service condition for all callers of FHIRPathEngine, potentially rendering FHIR validation services — including the FHIR Validator HTTP Endpoint — unavailable. There is no confidentiality or integrity impact; the vulnerability is limited to availability (GitHub Advisory).

1. Reconnaissance: Identify internet-facing FHIR Validator HTTP Endpoints or services using org.hl7.fhir.core versions ≤ 6.9.8, using service discovery tools or by inspecting Maven dependency manifests.
2. Craft malicious FHIRPath expression: Construct a FHIR resource containing a FHIRPath expression that invokes matches(), matchesFull(), or replaceMatches() with an evil regex pattern such as (a+)+$.
3. Craft malicious input string: Pair the regex with a long input string like "aaaaaaaaaaaaaaaaaaaaaa!" to maximize backtracking depth and CPU consumption.
4. Submit the resource: Send the crafted resource via HTTP POST to the FHIR Validator endpoint, triggering FHIRPathEngine evaluation of the malicious expression.
5. Achieve DoS: The Java regex engine enters exponential backtracking, consuming 100% of a CPU core indefinitely, causing the service to become unresponsive to legitimate requests (GitHub Advisory, HAPI FHIR Advisory).

• Network: Repeated HTTP POST requests to FHIR Validator endpoints containing FHIRPath expressions with regex patterns exhibiting nested quantifiers (e.g., (a+)+, (a|aa)+, (a+)*).
• Process: Java process (java) sustaining near-100% CPU utilization for extended periods without completing; thread dumps showing threads stuck in java.util.regex.Pattern or String.replaceAll() calls.
• Logs: Application logs showing FHIRPathEngine evaluation timeouts or uncaught exceptions from regex execution; repeated requests from the same source IP triggering validation of unusual FHIRPath expressions.
• System: Elevated load average on the host running the FHIR validation service; service health checks failing or timing out coinciding with inbound validation requests (GitHub Advisory).

Upgrade all affected ca.uhn.hapi.fhir packages to version 6.9.9 or 6.9.4.2 (backport), which contain fixes for both the incomplete timeout mechanism and the unprotected FHIRPathEngine call sites. Affected packages include org.hl7.fhir.dstu2, dstu2016may, dstu3, r4, r4b, r5, validation, and validation.cli. As a temporary workaround, restrict network access to FHIR Validator HTTP Endpoints to trusted clients only, and consider rate-limiting or input-length restrictions on submitted resources (GitHub Advisory, HAPI FHIR Advisory).