CVE-2026-33180 Details
Description
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.0, when setting headers in HTTP requests, the internal HTTP client sends headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the Location: response header value. Sending the same set of headers to subsequent hosts is a problem as this header often contains privacy sensitive information or data that could allow others to impersonate the client's request. This issue has been patched in release 6.9.0. No known workarounds are available.
A vulnerability exists in HAPI FHIR versions prior to 6.8.3, where the internal HTTP client improperly handles headers during redirects. When following a 30X HTTP response, headers are sent to the host specified in the Location response header, potentially leaking privacy-sensitive information or data that could be used to impersonate the client's request. This issue has been addressed in version 6.8.3.
Users can upgrade to HAPI FHIR version 6.8.3 or later to address this vulnerability. Instructions for updating can be found in the project's Maven repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Mar 20, 2026CISA-ADP
Assessed Mar 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2026-33180 | redhat-SADP | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2449841 | redhat-SADP | |
| https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33180.json | redhat-SADP | |
| https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-p7m9-v2cm-2h7m | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-201 | Insertion of Sensitive Information Into Sent Data | redhat-SADP |
Affected Products
| Product | Versions |
|---|---|
| HAPI FHIR | < 6.8.3 (semver) |
CPE
Remediation
| |
| org.hl7.fhir.convertors | All versions |
CPE
Remediation
| |
| org.hl7.fhir.dstu2 | All versions |
CPE
Remediation
| |
| org.hl7.fhir.dstu2016may | All versions |
CPE
Remediation
| |
| org.hl7.fhir.dstu3 | All versions |
CPE
Remediation
| |
| org.hl7.fhir.dstu3.support | All versions |
CPE
Remediation
| |
| org.hl7.fhir.model | All versions |
CPE
Remediation
| |
| org.hl7.fhir.r4 | All versions |
CPE
Remediation
| |
| org.hl7.fhir.r4b | All versions |
CPE
Remediation
| |
| org.hl7.fhir.r5 | All versions |
CPE
Remediation
| |
| org.hl7.fhir.utilities | All versions |
CPE
Remediation
| |
| org.hl7.fhir.validation | All versions |
CPE
Remediation
| |
| org.hl7.fhir.validation.cli | All versions |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 20, 2026 | New CVE Received | [email protected] |