Skip to content
OpenAdvisories

Product · dev.dsf

dsf-common-jetty

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 6.8
    CVE-2026-40939

    DSF: Missing Session Timeout for OIDC Sessions

    The Data Sharing Framework (DSF) implements a distributed process engine based on the BPMN 2.0 and FHIR R4 standards. Prior to 2.1.0, OIDC-authenticated sessions had no configured maximum inactivity timeout. Sessions persisted indefinitely after login, even a…

    datasharingframework dev.dsf dsf dsf-bpe-server Maven