CVE-2024-52007 — XXE vulnerability in...

HIGH

XXE vulnerability in XSLT parsing in `org.hl7.fhir.core`

Published November 8, 2024Updated February 4, 2026Source: osv

Summary

### Summary XSLT parsing performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag ( <!DOCTYPE foo [<!ENTITY example SYSTEM "/etc/passwd"> ]> could produce XML containing data from the host system. This impacts use cases where org.hl7.fhir.core is being used to within a host where external clients can submit XML. ### Details This is related to https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-6cr6-ph3p-f5rf, in which its fix ( https://github.com/hapifhir/org.hl7.fhir.core/issues/1571, https://github.com/hapifhir/org.hl7.fhir.core/pull/1717) was incomplete. ### References https://cwe.mitre.org/data/definitions/611.html https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#jaxp-documentbuilderfactory-saxparserfactory-and-dom4j

Advisory Timeline

First published November 8, 2024 (703 days ago).
Last revised February 4, 2026 — 452 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Maven

Update ca.uhn.hapi.fhir:org.hl7.fhir.r4 to 6.4.0 or later

<!-- Update pom.xml dependency version to 6.4.0 for ca.uhn.hapi.fhir:org.hl7.fhir.r4 -->

Maven

Update ca.uhn.hapi.fhir:org.hl7.fhir.utilities to 6.4.0 or later

<!-- Update pom.xml dependency version to 6.4.0 for ca.uhn.hapi.fhir:org.hl7.fhir.utilities -->

Maven

Update ca.uhn.hapi.fhir:org.hl7.fhir.r4b to 6.4.0 or later

<!-- Update pom.xml dependency version to 6.4.0 for ca.uhn.hapi.fhir:org.hl7.fhir.r4b -->

Maven

Update ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 to 6.4.0 or later

<!-- Update pom.xml dependency version to 6.4.0 for ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 -->

Maven

Update ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may to 6.4.0 or later

<!-- Update pom.xml dependency version to 6.4.0 for ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may -->

Maven

Update ca.uhn.hapi.fhir:org.hl7.fhir.r5 to 6.4.0 or later

<!-- Update pom.xml dependency version to 6.4.0 for ca.uhn.hapi.fhir:org.hl7.fhir.r5 -->

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (6)

Affects 1 ecosystem: maven (6).

Package	Ecosystem	Affected	Fixed In
ca.uhn.hapi.fhir:org.hl7.fhir.r4	maven	0.0.1, 0.0.14, 0.0.2, 0.1.18 (+317 more)	6.4.0
ca.uhn.hapi.fhir:org.hl7.fhir.utilities	maven	0.0.1, 0.0.14, 0.0.2, 0.1.18 (+317 more)	6.4.0
ca.uhn.hapi.fhir:org.hl7.fhir.r4b	maven	5.6.100, 5.6.101, 5.6.102, 5.6.103 (+190 more)	6.4.0
ca.uhn.hapi.fhir:org.hl7.fhir.dstu3	maven	0.0.1, 0.0.14, 0.0.2, 0.1.18 (+317 more)	6.4.0
ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may	maven	0.0.1, 0.0.14, 0.0.2, 0.1.18 (+317 more)	6.4.0
ca.uhn.hapi.fhir:org.hl7.fhir.r5	maven	0.0.1, 0.0.14, 0.0.2, 0.1.18 (+317 more)	6.4.0

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-611
XML External Entity (XXE)MITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 8.6 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

References

Frequently Asked Questions

What is CVE-2024-52007?: XXE vulnerability in XSLT parsing in `org.hl7.fhir.core` This vulnerability has been assigned a severity rating of HIGH (CVSS score: 8.6/10).
How do I check if my project is affected by CVE-2024-52007?: CVE-2024-52007 affects ca.uhn.hapi.fhir:org.hl7.fhir.r4, ca.uhn.hapi.fhir:org.hl7.fhir.utilities and ca.uhn.hapi.fhir:org.hl7.fhir.r4b (and 3 more). Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2024-52007 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

8.6

High exploitability or significant impact. Prioritize remediation within days.

Also Known As

GHSA-gr3c-q7xf-47vh

Related CVEs

CVE-2026-55471
CRITICAL
HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory
CVE-2023-24057
CRITICAL
MITM based Zip Slip in `ca.uhn.hapi.fhir:org.hl7.fhir.core`
CVE-2026-33180
CRITICAL
HAPI FHIR HTTP authentication leak in redirects
CVE-2026-34361
CRITICAL
FHIR Validator HTTP service has SSRF via /loadIG Chains with startsWith() Credential Leak for Authentication Token Theft
CVE-2026-45367
HIGH
HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint
CVE-2024-51132
HIGH
HAPI FHIR XML External Entity (XXE) vulnerability
CVE-2024-45294
HIGH
XXE vulnerability in XSLT transforms in `org.hl7.fhir.core`
CVE-2026-49485
HIGH
org.hl7.fhir.core: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies