CVE-2026-49485: 
Java vulnerability analysis and mitigation

CVE-2026-49485 is a Regular Expression Denial of Service (ReDoS) vulnerability in HAPI FHIR's org.hl7.fhir.core library, affecting all implementations of FHIRPathEngine prior to versions 6.9.9 and 6.9.4.2. The vulnerability allows unauthenticated remote attackers to cause denial of service by submitting FHIR resources containing malicious regex patterns that trigger catastrophic backtracking in Java's regex engine. Affected Maven packages include ca.uhn.hapi.fhir:org.hl7.fhir.dstu2, dstu2016may, dstu3, r4, r4b, r5, validation, and validation.cli (all versions ≤ 6.9.8). The advisory was published on June 1, 2026 (GitHub) and July 9, 2026 (NVD). The CVSS v3.1 base score is 7.5 (High) (GitHub Advisory, Feedly).

The root cause is Uncontrolled Resource Consumption (CWE-400) and Inefficient Regular Expression Complexity (CWE-1333). The FHIRPath functions matches(), matchesFull(), and replaceMatches() pass user-controlled regular expressions directly to Java's Pattern.compile() and String.replaceAll() via a timeout utility class (RegexTimeout). The timeout utility correctly cancelled the executor thread but could not interrupt the running regex evaluation within that thread, allowing it to persist indefinitely. Additionally, three modules contained FHIRPathEngine method calls that were entirely unprotected by the timeout utility. A crafted pattern such as (a+)+$ evaluated against input like "aaaaaaaaaaaaaaaaaaaaaa!" causes O(2^n) exponential backtracking, saturating a CPU core (GitHub Advisory, Fix Commit).

Successful exploitation exhausts CPU resources on the affected server, causing denial of service for the FHIR Validator HTTP endpoint and any application using the affected org.hl7.fhir.* modules. Because the vulnerability is network-exploitable with no authentication or user interaction required, a single attacker can repeatedly submit malicious FHIR resources to render the validator unavailable. There is no confidentiality or integrity impact; the sole consequence is availability loss, which is particularly significant in healthcare environments where FHIR validators underpin clinical data interoperability workflows (GitHub Advisory).

1. Reconnaissance: Identify internet-facing FHIR Validator HTTP endpoints or services using HAPI FHIR org.hl7.fhir.core versions ≤ 6.9.8 (e.g., via Shodan searches for FHIR validator services or known healthcare API endpoints).
2. Craft malicious FHIR resource: Construct a valid FHIR resource (e.g., a Patient or Observation resource) that includes a FHIRPath expression invoking matches(), matchesFull(), or replaceMatches() with a catastrophic backtracking regex pattern such as (a+)+$.
3. Prepare malicious input string: Pair the evil regex with a long input string (e.g., "aaaaaaaaaaaaaaaaaaaaaa!") that does not match the pattern, forcing the Java regex engine into exponential backtracking.
4. Submit to validator endpoint: Send the crafted FHIR resource via HTTP POST to the FHIR Validator HTTP endpoint. No authentication credentials are required.
5. Achieve denial of service: The regex evaluation consumes 100% of a CPU core indefinitely (or until the process is killed/restarted), making the validator unavailable to legitimate users. Repeated requests can sustain the DoS condition (GitHub Advisory).

• Network: Repeated HTTP POST requests to the FHIR Validator HTTP endpoint containing FHIRPath expressions with matches(), matchesFull(), or replaceMatches() functions and unusual regex patterns (e.g., nested quantifiers like (a+)+).
• Logs: Application logs showing FHIRException: Timeout evaluating regex: entries (present only in patched versions that caught the timeout); absence of such entries in unpatched versions despite high CPU usage.
• Process: Sustained 100% CPU utilization on the Java process hosting the FHIR validator, with thread dumps showing threads stuck in java.util.regex.Pattern or String.replaceAll() execution.
• Availability: Sudden unresponsiveness or extreme latency of the FHIR Validator HTTP endpoint coinciding with inbound requests containing FHIRPath expressions.

Upgrade to org.hl7.fhir.core version 6.9.9 (main branch) or 6.9.4.2 (maintenance branch) for all affected Maven packages (ca.uhn.hapi.fhir:org.hl7.fhir.dstu2, dstu2016may, dstu3, r4, r4b, r5, validation, validation.cli). The fix wraps funcReplaceMatches() calls in RegexTimeout.replaceAll() across the r4, r4b, and r5 modules, and extends timeout protection to previously unprotected FHIRPathEngine call sites. No configuration-based workaround is documented; upgrading to a patched version is the only recommended remediation. Organizations unable to upgrade immediately should consider placing the FHIR Validator HTTP endpoint behind an API gateway or WAF that can rate-limit or block requests with suspicious FHIRPath payloads (GitHub Advisory, Release 6.9.4.2).

The advisory was published by HAPI FHIR maintainer dotasek on GitHub on June 1, 2026, with the fix merged via pull request #2463 on May 29, 2026. A Mastodon post from @thehackerwire noted the vulnerability shortly after NVD publication. No significant broader media coverage or notable independent researcher commentary has been identified beyond standard vulnerability aggregator coverage (GitHub Advisory).