The vulnerability arises when the HAPI FHIR JSON parser processes deeply nested arrays or objects without limiting recursion depth. A crafted, syntactically valid FHIR JSON document can cause the parser to recurse without bound, raising a StackOverflowError before the resource is validated. This results in the request thread terminating abruptly, potentially leading to worker loss or process instability, and effectively denying service for valid requests.

The affected packages are part of the HAPI FHIR Java implementation, including org.hl7.fhir.utilities, org.hl7.fhir.validation, org.hl7.fhir.validation.cli, org.hl7.fhir.r5, and the core library org.hl7.fhir.core. Versions prior to 6.9.11 of these components are vulnerable. The fix is available in version 6.9.11 and later, which enforces a maximum nesting depth.

The CVSS score is 7.5, indicating a high severity denial‑of‑service vulnerability. EPSS is not available, and the issue is not listed in CISA's KEV catalog. The attack vector is inferred to be an external HTTP or API call that supplies the nested JSON payload, as the parser is invoked during resource validation. A successful exploit requires no special privileges and can be performed over the network, making the risk moderate to high for exposed services that accept FHIR JSON without proper resource limits.