Inefficient regular expression complexity in FHIR - CVE-2026-55470
Published: July 14, 2026
Vulnerability identifier: #VU137476
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-55470
CWE-ID: CWE-1333
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to inefficient regular expression complexity in FHIRPathEngine.matches() in the DSTU2 module when evaluating user-supplied FHIRPath expressions or resources containing a crafted matches() regular expression. A remote attacker can submit a crafted regular expression that triggers catastrophic backtracking to cause a denial of service.
The issue affects the DSTU2 implementation because the matches() path invokes raw regular expression matching without timeout protection.
Affected software
FHIR
Red Hat Camel for Spring Boot
Red Hat Camel for Spring Boot
How to mitigate CVE-2026-55470
Install security update from vendor's website.
FHIR - update to 6.9.10
Red Hat Camel for Spring Boot - update to 4.18
Red Hat Camel for Spring Boot - update to 4.18