The HAPI FHIR implementation contains a regular expression denial of service vulnerability in its FHIRPathEngine, corresponding to CWE‑1333: Regular Expression Denial of Service. User-controlled regular expressions passed to matches(), matchesFull(), or replaceMatches() are executed by the Java regex engine without timeouts, enabling catastrophic backtracking. An attacker can send a malicious pattern that consumes excessive CPU and memory, causing the FHIR Validator HTTP endpoint to become unresponsive and ultimately leading to a denial of service.

The affected product is HAPI FHIR’s org.hl7.fhir.core library. Any deployment running a version earlier than 6.9.7 that exposes the FHIRPath evaluation functions over the HTTP validator endpoint is vulnerable. A typical environment would be a healthcare application integrating FHIR resources on a Java servlet container such as Tomcat or Jetty.

The CVSS score of 7.5 indicates a high severity. The EPSS score is less than 1%, indicating a low but nonzero probability of exploitation. KEV is not listed in CISA KEV. The lack of timeout checks and the public exposure of the endpoint suggest a realistic remote exploitation possibility. The most direct attack vector is a remote HTTP request to the validator service that includes a crafted regular expression, which will trigger resource exhaustion before returning a response.