Loading...
Skip to main content
GeekWala

CVE-2026-33180 — HAPI FHIR HTTP authentication leak in...

CRITICAL

HAPI FHIR HTTP authentication leak in redirects

Published March 18, 2026Updated March 25, 2026Source: osv

Summary

### Impact When setting headers in HTTP requests, the internal HTTP client sends headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the Location: response header value. Sending the same set of headers to subsequent hosts is a problem as this header often contains privacy sensitive information or data that could allow others to impersonate the client's request. ### Patches This issue has been patched in release 6.8.3 ### Workarounds None.

Advisory Timeline

  • First published March 18, 2026 (208 days ago).
  • Last revised March 25, 2026 — 7 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Maven
Update ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 to 6.9.0 or later
<!-- Update pom.xml dependency version to 6.9.0 for ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 -->
Maven
Update ca.uhn.hapi.fhir:org.hl7.fhir.r4 to 6.9.0 or later
<!-- Update pom.xml dependency version to 6.9.0 for ca.uhn.hapi.fhir:org.hl7.fhir.r4 -->
Maven
Update ca.uhn.hapi.fhir:org.hl7.fhir.convertors to 6.9.0 or later
<!-- Update pom.xml dependency version to 6.9.0 for ca.uhn.hapi.fhir:org.hl7.fhir.convertors -->
Maven
Update ca.uhn.hapi.fhir:org.hl7.fhir.r5 to 6.9.0 or later
<!-- Update pom.xml dependency version to 6.9.0 for ca.uhn.hapi.fhir:org.hl7.fhir.r5 -->
Maven
Update ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may to 6.9.0 or later
<!-- Update pom.xml dependency version to 6.9.0 for ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may -->
Maven
Update ca.uhn.hapi.fhir:org.hl7.fhir.model to 6.9.0 or later
<!-- Update pom.xml dependency version to 6.9.0 for ca.uhn.hapi.fhir:org.hl7.fhir.model -->
Maven
Update ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 to 6.9.0 or later
<!-- Update pom.xml dependency version to 6.9.0 for ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 -->
Maven
Update ca.uhn.hapi.fhir:org.hl7.fhir.dstu3.support to 6.9.0 or later
<!-- Update pom.xml dependency version to 6.9.0 for ca.uhn.hapi.fhir:org.hl7.fhir.dstu3.support -->
Maven
Update ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli to 6.9.0 or later
<!-- Update pom.xml dependency version to 6.9.0 for ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli -->
Maven
Update ca.uhn.hapi.fhir:org.hl7.fhir.r4b to 6.9.0 or later
<!-- Update pom.xml dependency version to 6.9.0 for ca.uhn.hapi.fhir:org.hl7.fhir.r4b -->
Maven
Update ca.uhn.hapi.fhir:org.hl7.fhir.validation to 6.9.0 or later
<!-- Update pom.xml dependency version to 6.9.0 for ca.uhn.hapi.fhir:org.hl7.fhir.validation -->
Maven
Update ca.uhn.hapi.fhir:org.hl7.fhir.utilities to 6.9.0 or later
<!-- Update pom.xml dependency version to 6.9.0 for ca.uhn.hapi.fhir:org.hl7.fhir.utilities -->

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (12)

Affects 1 ecosystem: maven (12).

PackageEcosystemAffectedFixed In
ca.uhn.hapi.fhir:org.hl7.fhir.dstu2
maven
0.0.1, 0.0.14, 0.0.2, 0.1.18 (+375 more)6.9.0
ca.uhn.hapi.fhir:org.hl7.fhir.r4
maven
0.0.1, 0.0.14, 0.0.2, 0.1.18 (+375 more)6.9.0
ca.uhn.hapi.fhir:org.hl7.fhir.convertors
maven
0.0.1, 0.0.14, 0.0.2, 0.1.18 (+375 more)6.9.0
ca.uhn.hapi.fhir:org.hl7.fhir.r5
maven
0.0.1, 0.0.14, 0.0.2, 0.1.18 (+375 more)6.9.0
ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may
maven
0.0.1, 0.0.14, 0.0.2, 0.1.18 (+375 more)6.9.0
ca.uhn.hapi.fhir:org.hl7.fhir.model
maven
6.5.25, 6.5.26, 6.5.27, 6.5.28 (+23 more)6.9.0
ca.uhn.hapi.fhir:org.hl7.fhir.dstu3
maven
0.0.1, 0.0.14, 0.0.2, 0.1.18 (+375 more)6.9.0
ca.uhn.hapi.fhir:org.hl7.fhir.dstu3.support
maven
6.6.0, 6.6.1, 6.6.2, 6.6.3 (+19 more)6.9.0
ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli
maven
4.0.0, 4.0.1, 4.0.2, 4.0.3 (+3 more)6.9.0
ca.uhn.hapi.fhir:org.hl7.fhir.r4b
maven
5.6.100, 5.6.101, 5.6.102, 5.6.103 (+248 more)6.9.0
ca.uhn.hapi.fhir:org.hl7.fhir.validation
maven
0.0.1, 0.0.14, 0.0.2, 0.1.18 (+375 more)6.9.0
ca.uhn.hapi.fhir:org.hl7.fhir.utilities
maven
0.0.1, 0.0.14, 0.0.2, 0.1.18 (+375 more)6.9.0

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

  • CWE-200
    Information ExposureMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2026-33180?
HAPI FHIR HTTP authentication leak in redirects This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
How do I check if my project is affected by CVE-2026-33180?
CVE-2026-33180 affects ca.uhn.hapi.fhir:org.hl7.fhir.dstu2, ca.uhn.hapi.fhir:org.hl7.fhir.r4 and ca.uhn.hapi.fhir:org.hl7.fhir.convertors (and 9 more). Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-33180 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
9.8

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-p7m9-v2cm-2h7m

Related CVEs

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies