A high severity vulnerability, CVE-2026-49485 with a CVSS score of 7.5, exists in the FHIRPathEngine due to incorrect input validation during the evaluation of FHIRPath expressions, which are accepted by implementations without proper validation. This flaw allows an attacker to trigger catastrophic backtracking and cause a Denial-of-Service (DoS) by submitting a resource containing a malicious regular expression pattern that exhausts system resources. The attack vector is network-based, requires low complexity, and does not require user interaction. The vulnerability has significant business impact, as it can result in CPU exhaustion, system unresponsiveness, and service disruption.
We recommend you to refer below link: https://github.com/advisories/GHSA-7cmj-v6x8-frvv[/subscribe_to_unlock_form]
A high severity vulnerability, CVE-2026-49485 with a CVSS score of 7.5, exists in the FHIRPathEngine due to incorrect input validation during the evaluation of FHIRPath expressions, which are accepted by implementations without proper validation. This flaw allows an attacker to trigger catastrophic backtracking and cause a Denial-of-Service (DoS) by submitting a resource containing a malicious regular expression pattern that exhausts system resources. The attack vector is network-based, requires low complexity, and does not require user interaction. The vulnerability has significant business impact, as it can result in CPU exhaustion, system unresponsiveness, and service disruption.
We recommend you to refer below link: https://github.com/advisories/GHSA-7cmj-v6x8-frvv[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]