HAPI FHIR is a Java library implementing the HL7 FHIR standard for healthcare interoperability. In versions before 6.9.10, the fix for CVE-2026-45367 did not fully patch the DSTU2 module, leaving FHIRPathEngine.matches() to call raw String.matches(sw) without RegexTimeout protection while replaceMatches() had already been updated. This oversight allows an unauthenticated attacker to provide a crafted regex that triggers catastrophic backtracking, consuming server CPU and causing a denial of service. The flaw is categorized as a Regular Expression Denial‑of‑Service (CWE-1333) and is resolved in version 6.9.10. No authentication or elevated privileges are required. The vulnerability description has been updated in the source; the summary remains accurate.

The affected component is org.hl7.fhir.core’s DSTU2 implementation, known as HAPI FHIR. Any application incorporating this library in a version older than 6.9.10 is vulnerable. The issue was resolved in the 6.9.10 release; versions 6.9.10 and later are considered safe.

The CVSS score of 7.5 indicates high severity, while the EPSS score of <1% suggests a very low probability that the exploit is actively used in the wild. The vulnerability is not listed in the CISA KEV catalog, implying that widespread exploitation has not been observed. Attackers can remotely trigger the flaw by submitting malicious regex patterns in any FHIRPath evaluation request, and the absence of any authentication or privilege checks makes the attack straightforward even for automated tools.