This vulnerability allows an unauthenticated user to send a crafted JSON body to the /loadIG endpoint of the HAPI FHIR Validator HTTP service. Because the service does not validate the hostname, scheme, or domain of the supplied URL, it performs server‑side HTTP requests to that address. The response errors reveal internal host names or IPs, enabling a remote attacker to probe internal network services, cloud metadata endpoints, and map the topology. The lack of authentication and unchecked outbound traffic makes it a blind SSRF that can be used for reconnaissance rather than direct exploitation.

The flaw exists in the HAPI FHIR library from hapifhir:org.hl7.fhir.core prior to version 6.9.4. Only deployments that expose the /loadIG endpoint of the FHIR Validator HTTP service are affected without the patch. Systems running 6.9.4 or later are not vulnerable. No other vendors or versions are listed in the CVE record.

The CVSS score of 5.8 indicates moderate severity; the EPSS score below 1% implies a low probability of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. Nevertheless, because the endpoint is reachable over the network and requires no authentication, an unauthenticated attacker can carry out reconnaissance with minimal effort. The primary impact is internal network discovery, which could be a stepping stone to more serious attacks.