Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

HAPI FHIR libraries may let health data be tampered

CVE-2024-51132 · published 13 days ago
Summary

The HAPI FHIR Java libraries used for converting and handling FHIR data (including the convertors, DSTU2, DSTU2016May, DSTU3 and R4 packages) have a flaw that could allow an attacker to alter health information. This could affect applications that rely on these libraries for processing patient records. Update to the latest patched versions of the affected packages as soon as possible.

What to do
  • Update uhn ca.uhn.hapi.fhir:org.hl7.fhir.convertors to version 6.4.0.
  • Update uhn ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 to version 6.4.0.
  • Update uhn ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may to version 6.4.0.
  • Update uhn ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 to version 6.4.0.
  • Update uhn ca.uhn.hapi.fhir:org.hl7.fhir.r4 to version 6.4.0.
  • Update uhn ca.uhn.hapi.fhir:org.hl7.fhir.r4b to version 6.4.0.
  • Update uhn ca.uhn.hapi.fhir:org.hl7.fhir.r5 to version 6.4.0.
  • Update uhn ca.uhn.hapi.fhir:org.hl7.fhir.utilities to version 6.4.0.
  • Update uhn ca.uhn.hapi.fhir:org.hl7.fhir.validation to version 6.4.0.
  • Update uhn ca.uhn.hapi.fhir:org.hl7.fhir.utilities to version 6.4.0-aikido.2.
  • Update uhn ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 to version 6.4.0-aikido.2.
  • Update uhn ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 to version 6.4.0-aikido.2.
  • Update uhn ca.uhn.hapi.fhir:org.hl7.fhir.r4 to version 6.4.0-aikido.2.
  • Update uhn ca.uhn.hapi.fhir:org.hl7.fhir.r5 to version 6.4.0-aikido.2.
  • Update uhn ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may to version 6.4.0-aikido.2.
  • Update uhn ca.uhn.hapi.fhir:org.hl7.fhir.convertors to version 6.4.0-aikido.2.
  • Update uhn ca.uhn.hapi.fhir:org.hl7.fhir.validation to version 6.4.0-aikido.2.
  • Update uhn ca.uhn.hapi.fhir:org.hl7.fhir.r4b to version 6.4.0-aikido.2.
  • Update root io.root.ca.uhn.hapi.fhir:org.hl7.fhir.utilities to version 6.4.0-root.io.2.
  • Update root io.root.ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 to version 6.4.0-root.io.2.
  • Update root io.root.ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 to version 6.4.0-root.io.2.
  • Update root io.root.ca.uhn.hapi.fhir:org.hl7.fhir.r4 to version 6.4.0-root.io.2.
  • Update root io.root.ca.uhn.hapi.fhir:org.hl7.fhir.r5 to version 6.4.0-root.io.2.
  • Update root io.root.ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may to version 6.4.0-root.io.2.
  • Update root io.root.ca.uhn.hapi.fhir:org.hl7.fhir.convertors to version 6.4.0-root.io.2.
  • Update root io.root.ca.uhn.hapi.fhir:org.hl7.fhir.validation to version 6.4.0-root.io.2.
  • Update root io.root.ca.uhn.hapi.fhir:org.hl7.fhir.r4b to version 6.4.0-root.io.2.
  • Update ca.uhn.hapi.fhir:org.hl7.fhir.utilities to version 6.4.0-aikido.2.
  • Update ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 to version 6.4.0-aikido.2.
  • Update ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may to version 6.4.0-aikido.2.
  • Update ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 to version 6.4.0-aikido.2.
  • Update ca.uhn.hapi.fhir:org.hl7.fhir.r4 to version 6.4.0-aikido.2.
  • Update ca.uhn.hapi.fhir:org.hl7.fhir.r4b to version 6.4.0-aikido.2.
  • Update ca.uhn.hapi.fhir:org.hl7.fhir.r5 to version 6.4.0-aikido.2.
  • Update ca.uhn.hapi.fhir:org.hl7.fhir.validation to version 6.4.0-aikido.2.
  • Update ca.uhn.hapi.fhir:org.hl7.fhir.convertors to version 6.4.0-aikido.2.
  • Update io.root.ca.uhn.hapi.fhir:org.hl7.fhir.utilities to version 6.4.0-root.io.2.
  • Update io.root.ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 to version 6.4.0-root.io.2.
  • Update io.root.ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may to version 6.4.0-root.io.2.
  • Update io.root.ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 to version 6.4.0-root.io.2.
  • Update io.root.ca.uhn.hapi.fhir:org.hl7.fhir.r4 to version 6.4.0-root.io.2.
  • Update io.root.ca.uhn.hapi.fhir:org.hl7.fhir.r4b to version 6.4.0-root.io.2.
  • Update io.root.ca.uhn.hapi.fhir:org.hl7.fhir.r5 to version 6.4.0-root.io.2.
  • Update io.root.ca.uhn.hapi.fhir:org.hl7.fhir.validation to version 6.4.0-root.io.2.
  • Update io.root.ca.uhn.hapi.fhir:org.hl7.fhir.convertors to version 6.4.0-root.io.2.
Affected software
Ecosystem VendorProductAffected versions
maven uhn ca.uhn.hapi.fhir:org.hl7.fhir.convertors < 6.4.0
Fix: upgrade to 6.4.0
maven uhn ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 < 6.4.0
Fix: upgrade to 6.4.0
maven uhn ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may < 6.4.0
Fix: upgrade to 6.4.0
maven uhn ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 < 6.4.0
Fix: upgrade to 6.4.0
maven uhn ca.uhn.hapi.fhir:org.hl7.fhir.r4 < 6.4.0
Fix: upgrade to 6.4.0
maven uhn ca.uhn.hapi.fhir:org.hl7.fhir.r4b < 6.4.0
Fix: upgrade to 6.4.0
maven uhn ca.uhn.hapi.fhir:org.hl7.fhir.r5 < 6.4.0
Fix: upgrade to 6.4.0
maven uhn ca.uhn.hapi.fhir:org.hl7.fhir.utilities < 6.4.0
Fix: upgrade to 6.4.0
maven uhn ca.uhn.hapi.fhir:org.hl7.fhir.validation < 6.4.0
Fix: upgrade to 6.4.0
Root:Maven uhn ca.uhn.hapi.fhir:org.hl7.fhir.utilities < 6.4.0-aikido.2
Fix: upgrade to 6.4.0-aikido.2
Root:Maven uhn ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 < 6.4.0-aikido.2
Fix: upgrade to 6.4.0-aikido.2
Root:Maven uhn ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 < 6.4.0-aikido.2
Fix: upgrade to 6.4.0-aikido.2
Root:Maven uhn ca.uhn.hapi.fhir:org.hl7.fhir.r4 < 6.4.0-aikido.2
Fix: upgrade to 6.4.0-aikido.2
Root:Maven uhn ca.uhn.hapi.fhir:org.hl7.fhir.r5 < 6.4.0-aikido.2
Fix: upgrade to 6.4.0-aikido.2
Root:Maven uhn ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may < 6.4.0-aikido.2
Fix: upgrade to 6.4.0-aikido.2
Root:Maven uhn ca.uhn.hapi.fhir:org.hl7.fhir.convertors < 6.4.0-aikido.2
Fix: upgrade to 6.4.0-aikido.2
Root:Maven uhn ca.uhn.hapi.fhir:org.hl7.fhir.validation < 6.4.0-aikido.2
Fix: upgrade to 6.4.0-aikido.2
Root:Maven uhn ca.uhn.hapi.fhir:org.hl7.fhir.r4b < 6.4.0-aikido.2
Fix: upgrade to 6.4.0-aikido.2
Root:Maven root io.root.ca.uhn.hapi.fhir:org.hl7.fhir.utilities < 6.4.0-root.io.2
Fix: upgrade to 6.4.0-root.io.2
Root:Maven root io.root.ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 < 6.4.0-root.io.2
Fix: upgrade to 6.4.0-root.io.2
Root:Maven root io.root.ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 < 6.4.0-root.io.2
Fix: upgrade to 6.4.0-root.io.2
Root:Maven root io.root.ca.uhn.hapi.fhir:org.hl7.fhir.r4 < 6.4.0-root.io.2
Fix: upgrade to 6.4.0-root.io.2
Root:Maven root io.root.ca.uhn.hapi.fhir:org.hl7.fhir.r5 < 6.4.0-root.io.2
Fix: upgrade to 6.4.0-root.io.2
Root:Maven root io.root.ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may < 6.4.0-root.io.2
Fix: upgrade to 6.4.0-root.io.2
Root:Maven root io.root.ca.uhn.hapi.fhir:org.hl7.fhir.convertors < 6.4.0-root.io.2
Fix: upgrade to 6.4.0-root.io.2
Root:Maven root io.root.ca.uhn.hapi.fhir:org.hl7.fhir.validation < 6.4.0-root.io.2
Fix: upgrade to 6.4.0-root.io.2
Root:Maven root io.root.ca.uhn.hapi.fhir:org.hl7.fhir.r4b < 6.4.0-root.io.2
Fix: upgrade to 6.4.0-root.io.2
Root:Maven – ca.uhn.hapi.fhir:org.hl7.fhir.utilities < 6.4.0-aikido.2
Fix: upgrade to 6.4.0-aikido.2
Root:Maven – ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 < 6.4.0-aikido.2
Fix: upgrade to 6.4.0-aikido.2
Root:Maven – ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may < 6.4.0-aikido.2
Fix: upgrade to 6.4.0-aikido.2
Root:Maven – ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 < 6.4.0-aikido.2
Fix: upgrade to 6.4.0-aikido.2
Root:Maven – ca.uhn.hapi.fhir:org.hl7.fhir.r4 < 6.4.0-aikido.2
Fix: upgrade to 6.4.0-aikido.2
Root:Maven – ca.uhn.hapi.fhir:org.hl7.fhir.r4b < 6.4.0-aikido.2
Fix: upgrade to 6.4.0-aikido.2
Root:Maven – ca.uhn.hapi.fhir:org.hl7.fhir.r5 < 6.4.0-aikido.2
Fix: upgrade to 6.4.0-aikido.2
Root:Maven – ca.uhn.hapi.fhir:org.hl7.fhir.validation < 6.4.0-aikido.2
Fix: upgrade to 6.4.0-aikido.2
Root:Maven – ca.uhn.hapi.fhir:org.hl7.fhir.convertors < 6.4.0-aikido.2
Fix: upgrade to 6.4.0-aikido.2
Root:Maven – io.root.ca.uhn.hapi.fhir:org.hl7.fhir.utilities < 6.4.0-root.io.2
Fix: upgrade to 6.4.0-root.io.2
Root:Maven – io.root.ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 < 6.4.0-root.io.2
Fix: upgrade to 6.4.0-root.io.2
Root:Maven – io.root.ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may < 6.4.0-root.io.2
Fix: upgrade to 6.4.0-root.io.2
Root:Maven – io.root.ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 < 6.4.0-root.io.2
Fix: upgrade to 6.4.0-root.io.2
Root:Maven – io.root.ca.uhn.hapi.fhir:org.hl7.fhir.r4 < 6.4.0-root.io.2
Fix: upgrade to 6.4.0-root.io.2
Root:Maven – io.root.ca.uhn.hapi.fhir:org.hl7.fhir.r4b < 6.4.0-root.io.2
Fix: upgrade to 6.4.0-root.io.2
Root:Maven – io.root.ca.uhn.hapi.fhir:org.hl7.fhir.r5 < 6.4.0-root.io.2
Fix: upgrade to 6.4.0-root.io.2
Root:Maven – io.root.ca.uhn.hapi.fhir:org.hl7.fhir.validation < 6.4.0-root.io.2
Fix: upgrade to 6.4.0-root.io.2
Root:Maven – io.root.ca.uhn.hapi.fhir:org.hl7.fhir.convertors < 6.4.0-root.io.2
Fix: upgrade to 6.4.0-root.io.2
Original advisory text
CVE-2024-51132 in ca.uhn.hapi.fhir:org.hl7.fhir.utilities - Patched by Root
Root has patched CVE-2024-51132 in the ca.uhn.hapi.fhir:org.hl7.fhir.utilities package for Root:Maven. Multiple fixed versions available.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
8.8 High
Exploitation
2% chance of attack within 30 days
Type
CWE-601Open Redirect
CWE-611XML External Entity (XXE)
Timeline
Published5 Oct 2026
Updated15 Oct 2026
First seen6 Mar 2026
Sources
GHSA-4cf2-cxp3-rjr7 · GHSA
CVE-2024-51132 · NVD
ROOT-APP-MAVEN-CVE-2024-51132 · OSV
Track software like this
Free during beta