Hi,
I recently came across this article reporting three High-severity vulnerabilities in NextGen Mirth Connect, and since OIE forks from the last open-source release (4.5.2), I'd like to ask about their fix status in OIE.
CISA advisory ICSMA-26-253-01 lists three High-severity CVEs in Mirth Connect 4.5.2, which OIE forks from. Could you clarify their fix status in OIE (specifically 4.6.0)?
Existing work (#361 metadata-search SQLi, #408/#406 HL7 strict-parser XXE) seems to target different components, and I couldn't find any PR or advisory covering these three specifically.
Questions: Are they fixed in 4.6.0 (if so, which PRs)? If not, is a fix planned, and any recommended mitigations meanwhile?
Refs: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-253-01 · https://seclists.org/oss-sec/2026/q3/715 · https://www.databreachtoday.com/nextgen-mirth-connect-flaws-expose-downstream-system-logins-a-32789
Hi,
I recently came across this article reporting three High-severity vulnerabilities in NextGen Mirth Connect, and since OIE forks from the last open-source release (4.5.2), I'd like to ask about their fix status in OIE.
CISA advisory ICSMA-26-253-01 lists three High-severity CVEs in Mirth Connect 4.5.2, which OIE forks from. Could you clarify their fix status in OIE (specifically 4.6.0)?
_getTables/selectLimit(CVSS 8.3)Existing work (#361 metadata-search SQLi, #408/#406 HL7 strict-parser XXE) seems to target different components, and I couldn't find any PR or advisory covering these three specifically.
Questions: Are they fixed in 4.6.0 (if so, which PRs)? If not, is a fix planned, and any recommended mitigations meanwhile?
Refs: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-253-01 · https://seclists.org/oss-sec/2026/q3/715 · https://www.databreachtoday.com/nextgen-mirth-connect-flaws-expose-downstream-system-logins-a-32789