A high-severity denial of service vulnerability in HAPI FHIR allows attackers to exhaust system resources through complex regular expression processing.

The library is vulnerable to inefficient regular expression complexity (CWE-1333) and uncontrolled resource consumption (CWE-400). This permits unauthenticated attackers to send specially crafted payloads that force the application to consume excessive CPU or memory.

The vulnerability carries a CVSS score of 7.5, indicating a significant risk to service availability. Exploitation can lead to application crashes or severe performance degradation, effectively causing a denial of service for critical healthcare interoperability workflows.

Immediate Action: Upgrade to version 6.9.4.2 or 6.9.9 to resolve the underlying regex inefficiency.

Proactive Monitoring: Monitor application CPU and memory utilization patterns for sudden, unexplained spikes that may indicate a resource exhaustion attack.

Compensating Controls: Implement input length limits and request timeouts at the gateway level to mitigate the impact of complex payload processing.

Public Exploit Available: Unknown.

System administrators must update the HAPI FHIR core library to the recommended versions immediately. Ensuring the library is patched is essential to maintaining the stability of FHIR-based services and preventing potential service outages.