| Package | Affected versions | Patched versions |
|---|---|---|
| ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base | < 5.4.0 | 5.4.0 |
| hapi fhir | < 5.4.0 | 5.4.0 |
JPA Server in HAPI FHIR before 5.4.0 allows a user to deny service (e.g., disable access to the database after the attack stops) via history requests. This occurs because of a SELECT COUNT statement that requires a full index scan, with an accompanying large amount of server resources if there are many simultaneous history requests.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free