Dependency Update Request: HAPI-FHIR ≥ 6.9.0 (CVE-2026-33180)

[irene-hase]

Hello,

while reviewing the dependency tree of the Reference Validator, I noticed that
HAPI-FHIR 6.6.2 is currently used (e.g. hapi-fhir-validation, converter, utilities).

Older HAPI-FHIR versions are affected by CVE-2026-33180
("HTTP authentication leak in redirects").
The validator is probably not directly affected by this issue, but updating to HAPI-FHIR ≥ 6.9.0 might still make sense.
It would also help in our case, as our security/dependency scans currently flag this CVE due to the older version.

Are there plans to update the dependency and publish a new release?

Thank you very much.

[madduci]

Hello @irene-hase

thank you for the message. We know that the project is actually affected by the CVE and an upgrade is being performed. Unfortunately, migrating form HAPI 6.6.2 to 8.8.1 brings new challenges and breaking changes and these are already being analyzed, since the Validation is stricter and some assumptions are not valid anymore.

A branch is already opened in this repository.

Once we've cleared with our cooperating partners that these changes are acceptable, we will publish a new version.

Thanks for your patience

[irene-hase]

Hello @madduci,

thank you for the update and the transparency.
It’s good to hear that the impact is already being analyzed and that a branch is in progress.

Thanks for your work on this. We will wait for the new release.

[JonasLohmueller]

Hello,

is there any news regarding the release of this update?

Kind regards.

[madduci]

Hello @JonasLohmueller

Thank you for your message. Unfortunately we can't still give an ETA for the release of the update, we will provide new information as soon as we have internally completed our validation checks

[gutekunm]

Hello,

sorry to asks the same questions again, but are there any updates on this issue?

Kind regards

[madduci]

Hello @gutekunm,

Thanks for your message. Yes, we are finalising the last implementation and documentation changes, we will release the newer major update in August.
The new version will be based directly on the latest HL7 Core Validation library (>= 6.9.11).

Thanks for your patience

[todor-t]

Hello,

the release seems to be delayed.
Is there any new schedule for this update?

Best regards