Uncontrolled Resource Consumption in JPA Server in HAPI FHIR
JPA Server in HAPI FHIR before 5.4.0 allows a user to deny service (e.g., disable access to the database after the attack stops) via history requests. This occurs because of a SELECT COUNT statement that requires a full index scan, with an accompanying large amount of server resources if there are many simultaneous history requests.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Java / Kotlin (Maven) | ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base | < 5.4.0 | 5.4.0 |
References
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L- Weakness (CWE)
CWE-400- Platform
- Java / Kotlin (Maven)
- Package
ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base- Disclosed
- 16.06.2021
- Updated
- 11.10.2026 11:21
Sources and licenses
OSV / GitHub Advisory Database - GHSA-67f6-c8mx-4q2m - CC BY 4.0
Vulnerability history: ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base
All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.