The vulnerability arises when an attacker submits a FHIR resource containing an arbitrary FHIRPath expression that uses the matches(), matchesFull(), or replaceMatches() functions. The implementation forwards user‑controlled regular expressions directly to Java's Pattern.compile() and String.replaceAll() without a robust timeout, leading to catastrophic backtracking. This excessive CPU consumption can exhaust server resources and cause the FHIR Validator HTTP endpoint and any org.hl7.fhir.* modules that evaluate FHIRPath expressions to become unresponsive, resulting in a denial of service.

The affected vendor is HAPI FHIR, specifically the org.hl7.fhir.core library. All releases prior to 6.9.9 and 6.9.4.2 are vulnerable. Deployments that expose the FHIR Validator HTTP endpoint, or any application that processes client FHIR documents using the FHIRPathEngine of org.hl7.fhir.core, are impacted. Versions 6.9.9 and 6.9.4.2 contain a timeout fix that prevents the issue.

The CVSS score of 7.5 indicates high severity, and the EPSS score of less than 1% shows low but non‑zero likelihood of exploitation. The vulnerability is not listed in CISA's KEV catalog. Based on the description, it is inferred that an attacker can send a crafted payload to a publicly reachable validator endpoint, which would trigger catastrophic backtracking and exhaust CPU resources. Successful exploitation leads to service unavailability without leaking data, but the impact on availability is significant for healthcare interoperability services.