CVE-2026-55471 HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory

What is CVE-2026-55471?

CVE-2026-55471 is a high-severity vulnerability in hapifhir org.hl7.fhir.core, published on 8 Jul 2026.

Official description

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.10, org.hl7.fhir.utilities.XsltUtilities saxonTransform(...) overloads instantiated a bare net.sf.saxon.TransformerFactoryImpl() without ACCESS_EXTERNAL_DTD or ACCESS_EXTERNAL_STYLESHEET restrictions, allowing an attacker who controls or can tamper with transformed XML to trigger XML External Entity injection for local file disclosure and blind XXE or SSRF to arbitrary URLs reachable from the host. This issue is fixed in version 6.9.10.

Weakness: CWE-611

Which versions are affected by CVE-2026-55471?

2 open source packages ship an affected version, including ca.uhn.hapi.fhir:org.hl7.fhir.utilities. It affects 1 product.

Products include Hapifhir Hl7 Fhir Core.

How do I fix CVE-2026-55471?

Upgrade ca.uhn.hapi.fhir:org.hl7.fhir.utilities to 6.9.10 or later.

Is CVE-2026-55471 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-55471 exists.

Other vulnerabilities in hapifhir org.hl7.fhir.core

• CVE-2026-34361 HAPI FHIR: Unauthenticated SSRF via /loadIG Chains with startsWith() Credential Leak for Authentication Token Theft Critical 9.3
• CVE-2023-24057 MITM based Zip Slip in `ca.uhn.hapi.fhir:org.hl7.fhir.core` High 8.1
• CVE-2026-55470 HAPI FHIR: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoS High 7.5
• CVE-2023-28465 HL7 FHIR Partial Path Zip Slip due to bypass of CVE-2023-24057 High 7.5
• CVE-2026-34359 HAPI FHIR: Authentication Credential Leakage via Improper URL Prefix Matching on HTTP Redirect in HAPI FHIR Core High 7.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-2f55-g35j-5jmf, ROOT-APP-MAVEN-CVE-2026-55471.