As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-113873, CVE-2026-113874, CVE-2026-113875, CVE-2026-113876: HAPI FHIR cross-tenant partition override, authorization bypasses and gzip heap exhaustion
CISA published four CVEs affecting HAPI FHIR, an open-source Java implementation of HL7 FHIR, coordinated under VINCE case VU#394579. The vulnerabilities include cross-tenant partition override, authorization bypasses, and gzip heap exhaustion, with the most severe allowing a caller authorized for one tenant to read or write data in another tenant's partition. The issues were reproduced on HAPI FHIR version 8.10.0.
Why it matters: Organizations running HAPI FHIR as part of healthcare information systems or multi-tenant deployments face immediate risk of data exposure and unauthorized modification across tenant boundaries; patch or isolate affected instances.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-113873, CVE-2026-113874, CVE-2026-113875, CVE-2026-113876: HAPI FHIR cross-tenant partition override, authorization bypasses and gzip heap exhaustion
CISA published four CVEs affecting HAPI FHIR, an open-source Java implementation of HL7 FHIR, coordinated under VINCE case VU#394579. The vulnerabilities include cross-tenant partition override, authorization bypasses, and gzip heap exhaustion, with the most severe allowing a caller authorized for one tenant to read or write data in another tenant's partition. The issues were reproduced on HAPI FHIR version 8.10.0.
Why it matters: Organizations running HAPI FHIR as part of healthcare information systems or multi-tenant deployments face immediate risk of data exposure and unauthorized modification across tenant boundaries; patch or isolate affected instances.
- Source published
- First seen by Cybersecurity Tracker