Skip to content

Product

dev.dsf/dsf-bpe-server vulnerabilities

2 published CVES affecting dev.dsf/dsf-bpe-server, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
2
Critical
0
High
0
Medium
2
Low
0
Unscored
0
CISA KEV
0

Latest dev.dsf/dsf-bpe-server CVEs

Newest publication first

  1. CVE-2026-40942 DSF: Inverted Time Comparison in OIDC JWKS and Token Cache

    Published
    MediumCVSS 6.3 EPSS 0.29%

    The Data Sharing Framework (DSF) implements a distributed process engine based on the BPMN 2.0 and FHIR R4 standards. Prior to 2.1.0, The OIDC JWKS and Metadata Document caches used an inverted time comparison (isBefore instead of isAfter), causing the cache to never return cache...

  2. CVE-2026-40939 DSF: Missing Session Timeout for OIDC Sessions

    Published
    MediumCVSS 6.8 EPSS 0.15%

    The Data Sharing Framework (DSF) implements a distributed process engine based on the BPMN 2.0 and FHIR R4 standards. Prior to 2.1.0, OIDC-authenticated sessions had no configured maximum inactivity timeout. Sessions persisted indefinitely after login, even after the OIDC access...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.