CVE-2024-45294 — XXE vulnerability in...

HIGH

XXE vulnerability in XSLT transforms in `org.hl7.fhir.core`

Published September 6, 2024Updated February 4, 2026Source: osv

Summary

### Impact XSLT transforms performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag ( `<!DOCTYPE foo [<!ENTITY example SYSTEM "/etc/passwd"> ]>` could produce XML containing data from the host system. This impacts use cases where org.hl7.fhir.core is being used to within a host where external clients can submit XML. ### Patches This issue has been patched in release 6.3.23 ### Workarounds None. ### References [MITRE CWE](https://cwe.mitre.org/data/definitions/611.html) [OWASP XML External Entity Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#transformerfactory)

Advisory Timeline

First published September 6, 2024 (766 days ago).
Last revised February 4, 2026 — 515 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Maven

Update ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may to 6.3.23 or later

<!-- Update pom.xml dependency version to 6.3.23 for ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may -->

Maven

Update ca.uhn.hapi.fhir:org.hl7.fhir.utilities to 6.3.23 or later

<!-- Update pom.xml dependency version to 6.3.23 for ca.uhn.hapi.fhir:org.hl7.fhir.utilities -->

Maven

Update ca.uhn.hapi.fhir:org.hl7.fhir.r4b to 6.3.23 or later

<!-- Update pom.xml dependency version to 6.3.23 for ca.uhn.hapi.fhir:org.hl7.fhir.r4b -->

Maven

Update ca.uhn.hapi.fhir:org.hl7.fhir.r5 to 6.3.23 or later

<!-- Update pom.xml dependency version to 6.3.23 for ca.uhn.hapi.fhir:org.hl7.fhir.r5 -->

Maven

Update ca.uhn.hapi.fhir:org.hl7.fhir.r4 to 6.3.23 or later

<!-- Update pom.xml dependency version to 6.3.23 for ca.uhn.hapi.fhir:org.hl7.fhir.r4 -->

Maven

Update ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 to 6.3.23 or later

<!-- Update pom.xml dependency version to 6.3.23 for ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 -->

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (6)

Affects 1 ecosystem: maven (6).

Package	Ecosystem	Affected	Fixed In
ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may	maven	0.0.1, 0.0.14, 0.0.2, 0.1.18 (+307 more)	6.3.23
ca.uhn.hapi.fhir:org.hl7.fhir.utilities	maven	0.0.1, 0.0.14, 0.0.2, 0.1.18 (+307 more)	6.3.23
ca.uhn.hapi.fhir:org.hl7.fhir.r4b	maven	5.6.100, 5.6.101, 5.6.102, 5.6.103 (+180 more)	6.3.23
ca.uhn.hapi.fhir:org.hl7.fhir.r5	maven	0.0.1, 0.0.14, 0.0.2, 0.1.18 (+307 more)	6.3.23
ca.uhn.hapi.fhir:org.hl7.fhir.r4	maven	0.0.1, 0.0.14, 0.0.2, 0.1.18 (+307 more)	6.3.23
ca.uhn.hapi.fhir:org.hl7.fhir.dstu3	maven	0.0.1, 0.0.14, 0.0.2, 0.1.18 (+307 more)	6.3.23

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-611
XML External Entity (XXE)MITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 8.6 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

References

Frequently Asked Questions

What is CVE-2024-45294?: XXE vulnerability in XSLT transforms in `org.hl7.fhir.core` This vulnerability has been assigned a severity rating of HIGH (CVSS score: 8.6/10).
How do I check if my project is affected by CVE-2024-45294?: CVE-2024-45294 affects ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may, ca.uhn.hapi.fhir:org.hl7.fhir.utilities and ca.uhn.hapi.fhir:org.hl7.fhir.r4b (and 3 more). Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2024-45294 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

8.6

High exploitability or significant impact. Prioritize remediation within days.

Also Known As

GHSA-6cr6-ph3p-f5rf

Related CVEs

CVE-2026-55471
CRITICAL
HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory
CVE-2023-24057
CRITICAL
MITM based Zip Slip in `ca.uhn.hapi.fhir:org.hl7.fhir.core`
CVE-2026-33180
CRITICAL
HAPI FHIR HTTP authentication leak in redirects
CVE-2026-34361
CRITICAL
FHIR Validator HTTP service has SSRF via /loadIG Chains with startsWith() Credential Leak for Authentication Token Theft
CVE-2026-45367
HIGH
HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint
CVE-2024-51132
HIGH
HAPI FHIR XML External Entity (XXE) vulnerability
CVE-2026-49485
HIGH
org.hl7.fhir.core: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint
CVE-2024-52007
HIGH
XXE vulnerability in XSLT parsing in `org.hl7.fhir.core`

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies