The defect resides in the DSTU2 module of the HAPI FHIR Java library. Prior to version 6.9.10, a patch for CVE-2026-45367 incompletely addressed the DSTU2 module, leaving FHIRPathEngine.matches() to call raw String.matches(sw) without RegexTimeout protection while replaceMatches() had already been updated. This omission enables an unauthenticated attacker to supply a crafted regular expression that triggers catastrophic backtracking, exhausting server CPU and causing a denial‑of‑service. The vulnerability is classified as a Regular Expression Denial‑of‑Service (CWE-1333) and is fully mitigated in version 6.9.10. No authentication or elevated privileges are required to exploit the flaw.

The affected component is org.hl7.fhir.core’s DSTU2 implementation, known as HAPI FHIR. Any application incorporating this library in a version older than 6.9.10 is vulnerable. The issue was resolved in the 6.9.10 release; versions 6.9.10 and later are considered safe.

The CVSS score of 7.5 indicates high severity, while the EPSS score of <1% suggests a very low probability that the exploit is actively used in the wild. The vulnerability is not listed in the CISA KEV catalog, implying that widespread exploitation has not been observed. Attackers can remotely trigger the flaw by submitting malicious regex patterns in any FHIRPath evaluation request, and the absence of any authentication or privilege checks makes the attack straightforward even for automated tools.