Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.1

Root FHIR Utilities Data Exposure Risk on Root:Maven

CVE-2026-34359 · published 5 days ago
Summary

A vulnerability in Root FHIR Utilities on Root:Maven could allow attackers to access sensitive data. This issue has been fixed by Root, and multiple updated versions are available. Update your Root:Maven installation to a patched version to ensure your data remains secure.

What to do
  • Update uhn ca.uhn.hapi.fhir:org.hl7.fhir.core to version 6.9.4.
  • Update uhn ca.uhn.hapi.fhir:org.hl7.fhir.utilities to version 6.9.4.
  • Update root io.root.ca.uhn.hapi.fhir:org.hl7.fhir.utilities to version 6.9.0-root.io.2.
  • Update root io.root.ca.uhn.hapi.fhir:org.hl7.fhir.utilities to version 6.9.0-root.io.3.
  • Update uhn ca.uhn.hapi.fhir:org.hl7.fhir.core to version 6.9.0-aikido.9.
  • Update uhn ca.uhn.hapi.fhir:org.hl7.fhir.core to version 6.5.27-aikido.1.
  • Update root io.root.ca.uhn.hapi.fhir:org.hl7.fhir.utilities to version 6.5.27-root.io.1.
  • Update root io.root.ca.uhn.hapi.fhir:org.hl7.fhir.core to version 6.5.27-root.io.1.
  • Update root io.root.ca.uhn.hapi.fhir:org.hl7.fhir.utilities to version 6.9.0-root.io.4.
  • Update root io.root.ca.uhn.hapi.fhir:org.hl7.fhir.utilities to version 6.7.9-root.io.1.
  • Update root io.root.ca.uhn.hapi.fhir:org.hl7.fhir.core to version 6.7.9-root.io.1.
  • Update root io.root.ca.uhn.hapi.fhir:org.hl7.fhir.utilities to version 6.7.9-root.io.2.
  • Update root io.root.ca.uhn.hapi.fhir:org.hl7.fhir.core to version 6.7.9-root.io.2.
  • Update root io.root.ca.uhn.hapi.fhir:org.hl7.fhir.utilities to version 6.9.0-root.io.6.
  • Update root io.root.ca.uhn.hapi.fhir:org.hl7.fhir.core to version 6.9.0-root.io.6.
  • Update root io.root.ca.uhn.hapi.fhir:org.hl7.fhir.utilities to version 6.7.9-root.io.5.
  • Update root io.root.ca.uhn.hapi.fhir:org.hl7.fhir.core to version 6.7.9-root.io.5.
  • Update root io.root.ca.uhn.hapi.fhir:org.hl7.fhir.utilities to version 6.9.0-root.io.7.
  • Update root io.root.ca.uhn.hapi.fhir:org.hl7.fhir.core to version 6.9.0-root.io.7.
  • Update root io.root.ca.uhn.hapi.fhir:org.hl7.fhir.utilities to version 6.7.9-root.io.6.
  • Update root io.root.ca.uhn.hapi.fhir:org.hl7.fhir.core to version 6.7.9-root.io.6.
  • Update uhn ca.uhn.hapi.fhir:org.hl7.fhir.utilities to version 6.7.9-aikido.6.
  • Update uhn ca.uhn.hapi.fhir:org.hl7.fhir.core to version 6.7.9-aikido.6.
  • Update root io.root.ca.uhn.hapi.fhir:org.hl7.fhir.core to version 6.9.0-root.io.9.
  • Update uhn ca.uhn.hapi.fhir:org.hl7.fhir.utilities to version 6.9.0-aikido.9.
  • Update root io.root.ca.uhn.hapi.fhir:org.hl7.fhir.utilities to version 6.7.9-root.io.8.
  • Update root io.root.ca.uhn.hapi.fhir:org.hl7.fhir.core to version 6.7.9-root.io.8.
  • Update uhn ca.uhn.hapi.fhir:org.hl7.fhir.utilities to version 6.7.9-aikido.8.
  • Update uhn ca.uhn.hapi.fhir:org.hl7.fhir.core to version 6.7.9-aikido.8.
  • Update root io.root.ca.uhn.hapi.fhir:org.hl7.fhir.utilities to version 6.9.0-root.io.10.
  • Update root io.root.ca.uhn.hapi.fhir:org.hl7.fhir.core to version 6.9.0-root.io.10.
  • Update uhn ca.uhn.hapi.fhir:org.hl7.fhir.utilities to version 6.9.0-aikido.10.
  • Update uhn ca.uhn.hapi.fhir:org.hl7.fhir.core to version 6.9.0-aikido.10.
  • Update uhn ca.uhn.hapi.fhir:org.hl7.fhir.utilities to version 6.5.27-aikido.1.
  • Update uhn ca.uhn.hapi.fhir:org.hl7.fhir.utilities to version 6.4.0-aikido.2.
  • Update uhn ca.uhn.hapi.fhir:org.hl7.fhir.core to version 6.4.0-aikido.2.
  • Update root io.root.ca.uhn.hapi.fhir:org.hl7.fhir.utilities to version 6.4.0-root.io.2.
  • Update root io.root.ca.uhn.hapi.fhir:org.hl7.fhir.core to version 6.4.0-root.io.2.
  • Update ca.uhn.hapi.fhir:org.hl7.fhir.utilities to version 6.0.1-aikido.2.
  • Update ca.uhn.hapi.fhir:org.hl7.fhir.core to version 6.4.0-aikido.2.
  • Update io.root.ca.uhn.hapi.fhir:org.hl7.fhir.utilities to version 6.0.1-root.io.2.
  • Update io.root.ca.uhn.hapi.fhir:org.hl7.fhir.core to version 6.4.0-root.io.2.
  • Update ca.uhn.hapi.fhir:org.hl7.fhir.utilities to version 6.0.1-aikido.3.
  • Update io.root.ca.uhn.hapi.fhir:org.hl7.fhir.utilities to version 6.0.1-root.io.3.
  • Update ca.uhn.hapi.fhir:org.hl7.fhir.utilities to version 6.0.1-aikido.4.
  • Update io.root.ca.uhn.hapi.fhir:org.hl7.fhir.utilities to version 6.0.1-root.io.4.
  • Update hapifhir hl7_fhir_core to version 6.9.4 or later.
Affected software
Ecosystem VendorProductAffected versions
maven uhn ca.uhn.hapi.fhir:org.hl7.fhir.core < 6.9.4
Fix: upgrade to 6.9.4
maven uhn ca.uhn.hapi.fhir:org.hl7.fhir.utilities < 6.9.4
Fix: upgrade to 6.9.4
– hapifhir hl7_fhir_core < 6.9.4
cpe:2.3:a:hapifhir:hl7_fhir_core:*:*:*:*:*:*:*:*
Root:Maven root io.root.ca.uhn.hapi.fhir:org.hl7.fhir.utilities < 6.9.0-root.io.2
< 6.9.0-root.io.3
< 6.5.27-root.io.1
< 6.9.0-root.io.4
< 6.7.9-root.io.1
< 6.7.9-root.io.2
< 6.9.0-root.io.6
< 6.7.9-root.io.5
< 6.9.0-root.io.7
< 6.7.9-root.io.6
< 6.7.9-root.io.8
< 6.9.0-root.io.10
1 more version range
Fix: upgrade to 6.9.0-root.io.2
Root:Maven uhn ca.uhn.hapi.fhir:org.hl7.fhir.core < 6.9.0-aikido.9
< 6.5.27-aikido.1
< 6.7.9-aikido.6
< 6.7.9-aikido.8
< 6.9.0-aikido.10
< 6.4.0-aikido.2
Fix: upgrade to 6.9.0-aikido.9
Root:Maven root io.root.ca.uhn.hapi.fhir:org.hl7.fhir.core < 6.5.27-root.io.1
< 6.7.9-root.io.1
< 6.7.9-root.io.2
< 6.9.0-root.io.6
< 6.7.9-root.io.5
< 6.9.0-root.io.7
< 6.7.9-root.io.6
< 6.9.0-root.io.9
< 6.7.9-root.io.8
< 6.9.0-root.io.10
< 6.4.0-root.io.2
Fix: upgrade to 6.5.27-root.io.1
Root:Maven uhn ca.uhn.hapi.fhir:org.hl7.fhir.utilities < 6.7.9-aikido.6
< 6.9.0-aikido.9
< 6.7.9-aikido.8
< 6.9.0-aikido.10
< 6.5.27-aikido.1
< 6.4.0-aikido.2
Fix: upgrade to 6.7.9-aikido.6
Root:Maven – ca.uhn.hapi.fhir:org.hl7.fhir.utilities < 6.0.1-aikido.2
< 6.0.1-aikido.3
< 6.0.1-aikido.4
Fix: upgrade to 6.0.1-aikido.2
Root:Maven – ca.uhn.hapi.fhir:org.hl7.fhir.core < 6.4.0-aikido.2
Fix: upgrade to 6.4.0-aikido.2
Root:Maven – io.root.ca.uhn.hapi.fhir:org.hl7.fhir.utilities < 6.0.1-root.io.2
< 6.0.1-root.io.3
< 6.0.1-root.io.4
Fix: upgrade to 6.0.1-root.io.2
Root:Maven – io.root.ca.uhn.hapi.fhir:org.hl7.fhir.core < 6.4.0-root.io.2
Fix: upgrade to 6.4.0-root.io.2
Original advisory text
CVE-2026-34359 in ca.uhn.hapi.fhir:org.hl7.fhir.utilities - Patched by Root
Root has patched CVE-2026-34359 in the ca.uhn.hapi.fhir:org.hl7.fhir.utilities package for Root:Maven. Multiple fixed versions available.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.1 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-346Origin Validation Error
Timeline
Published5 Oct 2026
Updated9 Oct 2026
First seen30 Mar 2026
Sources
GHSA-fgv2-4q4g-wc35 · GHSA
CVE-2026-34359 · NVD
ROOT-APP-MAVEN-CVE-2026-34359 · OSV
Track software like this
Free during beta