CVE-2026-33180: HAPI FHIR HTTP authentication leak in redirects
Impact When setting headers in HTTP requests, the internal HTTP client sends headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the Location: response header value.
Published Mar 18, 2026 · Updated Mar 25, 2026
Affected packages
ca.uhn.hapi.fhir:org.hl7.fhir.utilities
- Ecosystem
- Maven
- Affected
- < 6.9.0
- Fixed in
- 6.9.0
- Check
mvn dependency:tree -Dincludes=ca.uhn.hapi.fhir:org.hl7.fhir.utilities
ca.uhn.hapi.fhir:org.hl7.fhir.convertors
- Ecosystem
- Maven
- Affected
- < 6.9.0
- Fixed in
- 6.9.0
- Check
mvn dependency:tree -Dincludes=ca.uhn.hapi.fhir:org.hl7.fhir.convertors
ca.uhn.hapi.fhir:org.hl7.fhir.dstu2
- Ecosystem
- Maven
- Affected
- < 6.9.0
- Fixed in
- 6.9.0
- Check
mvn dependency:tree -Dincludes=ca.uhn.hapi.fhir:org.hl7.fhir.dstu2
ca.uhn.hapi.fhir:org.hl7.fhir.dstu3
- Ecosystem
- Maven
- Affected
- < 6.9.0
- Fixed in
- 6.9.0
- Check
mvn dependency:tree -Dincludes=ca.uhn.hapi.fhir:org.hl7.fhir.dstu3
ca.uhn.hapi.fhir:org.hl7.fhir.dstu3.support
- Ecosystem
- Maven
- Affected
- < 6.9.0
- Fixed in
- 6.9.0
- Check
mvn dependency:tree -Dincludes=ca.uhn.hapi.fhir:org.hl7.fhir.dstu3.support
ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may
- Ecosystem
- Maven
- Affected
- < 6.9.0
- Fixed in
- 6.9.0
- Check
mvn dependency:tree -Dincludes=ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may
ca.uhn.hapi.fhir:org.hl7.fhir.model
- Ecosystem
- Maven
- Affected
- < 6.9.0
- Fixed in
- 6.9.0
- Check
mvn dependency:tree -Dincludes=ca.uhn.hapi.fhir:org.hl7.fhir.model
ca.uhn.hapi.fhir:org.hl7.fhir.r4
- Ecosystem
- Maven
- Affected
- < 6.9.0
- Fixed in
- 6.9.0
- Check
mvn dependency:tree -Dincludes=ca.uhn.hapi.fhir:org.hl7.fhir.r4
ca.uhn.hapi.fhir:org.hl7.fhir.r4b
- Ecosystem
- Maven
- Affected
- < 6.9.0
- Fixed in
- 6.9.0
- Check
mvn dependency:tree -Dincludes=ca.uhn.hapi.fhir:org.hl7.fhir.r4b
ca.uhn.hapi.fhir:org.hl7.fhir.r5
- Ecosystem
- Maven
- Affected
- < 6.9.0
- Fixed in
- 6.9.0
- Check
mvn dependency:tree -Dincludes=ca.uhn.hapi.fhir:org.hl7.fhir.r5
ca.uhn.hapi.fhir:org.hl7.fhir.validation
- Ecosystem
- Maven
- Affected
- < 6.9.0
- Fixed in
- 6.9.0
- Check
mvn dependency:tree -Dincludes=ca.uhn.hapi.fhir:org.hl7.fhir.validation
ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli
- Ecosystem
- Maven
- Affected
- < 6.9.0
- Fixed in
- 6.9.0
- Check
mvn dependency:tree -Dincludes=ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Impact
When setting headers in HTTP requests, the internal HTTP client sends headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the Location: response header value.
Sending the same set of headers to subsequent hosts is a problem as this header often contains privacy sensitive information or data that could allow others to impersonate the client's request.
Patches
This issue has been patched in release 6.8.3
Workarounds
None.
Credited to ElliotSilver.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology