CVE-2026-55471: XXE in HAPI FHIR Core Saxon Transforms

CVE-2026-55471 is a critical XML external entity flaw (CVSS 9.1) in HAPI FHIR core (org.hl7.fhir.core) before 6.9.10. The saxonTransform helpers create a Saxon transformer with no external access limits, so tampered XML can disclose local files or trigger server-side requests. Upgrade to 6.9.10.

What's affected

• org.hl7.fhir.utilities and the HAPI FHIR core libraries before 6.9.10, per the record.
• Fixed in 6.9.10. The release notes say XXE protection now covers Saxon specific implementations.
• Code that calls the saxonTransform overloads of XsltUtilities on XML an attacker can control or alter.

How to check if you're exposed

Find the library version in your Java projects.

mvn dependency:tree -Dincludes=*:org.hl7.fhir.utilities
./gradlew dependencies | grep -i org.hl7.fhir

Then search your own code for saxonTransform. Many projects use the library through the validator or other tools, so also check what those tools do with XML from outside.

What to do now

1. Upgrade org.hl7.fhir.core artifacts to 6.9.10 or later and rebuild.
2. Update tools and images that bundle the validator or utilities.
3. Do not run XSLT on XML from untrusted sources until you have upgraded.
4. Restrict outbound network access from services that transform XML, to limit blind requests.

Why it matters

The class is CWE-611, improper restriction of XML external entity reference. The advisory points out an inconsistency inside one file: the regular transform helpers used a hardened factory that sets external access limits to empty, while the saxonTransform helpers made a bare Saxon factory.

That is a familiar pattern. One path is protected and a sibling path is forgotten. The effect is local file disclosure and blind requests to any URL reachable from the host. The record does not mark the CVE as exploited in the wild.

For your own projects, the free in-browser dependency scan needs no install, and the Gold directory tracks this CVE.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-2f55-g35j-5jmf
• https://github.com/hapifhir/org.hl7.fhir.core/releases/tag/6.9.10

Last reviewed: 19 October 2026.