Report: CVE-2026-34361 - HAPI FHIR: Unauthenticated SSRF via /loadIG Chains with startsWith() Credential

Report: CVE-2026-34361 - HAPI FHIR: Unauthenticated SSRF via /loadIG Chains with startsWith() Credential

CVE ID :CVE-2026-34361 Published : March 31, 2026, 5:16 p.m. | 52 minutes ago Description :HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.4, the FHIR Validator HTTP service exposes an unauthenticated

CVE Details

Published
March 31, 2026
Affected Product: Java