Description
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, XhtmlParser.java imposes no maximum element nesting depth, so a deeply nested text.div narrative triggers unbounded recursion between parseElementInner() and parseElement(), raising a StackOverflowError. An attacker who can submit FHIR resources containing such narratives can thus crash a parsing or validation worker thread, affecting validator services and any application that parses attacker-supplied FHIR JSON or XML. This issue is fixed in version 6.9.11.
Published: 2026-08-07
Score: 7.5 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability resides in HAPI FHIR’s XHTML parser, which accepts arbitrarily deep element nesting. A maliciously crafted FHIR resource can trigger unbounded recursion, leading the parser to raise a StackOverflowError. The resulting crash disables the parsing or validation worker thread, causing a denial of service for applications that process attacker supplied FHIR JSON or XML.

Affected Systems

Affecting the HAPI FHIR core library (org.hl7.fhir.core) and related components (org.hl7.fhir.r5, org.hl7.fhir.utilities, org.hl7.fhir.validation, org.hl7.fhir.validation.cli) in any installation running a pre‑6.9.11 version. Any application or service that uses these libraries to parse or validate incoming FHIR resources is susceptible.

Risk and Exploitability

With a CVSS score of 7.5 the flaw is considered High. The EPSS score is not available, and the vulnerability is not listed in CISA KEV catalog. An attacker who can submit FHIR resources, for example through a publicly exposed API or ingestion service, can exploit the flaw remotely by uploading a deeply nested narrative, leading to service disruption.

Generated by OpenCVE AI on August 7, 2026 at 21:25 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to HAPI FHIR version 6.9.11 or later.
  • If an immediate upgrade is impossible, restrict input by rejecting or sanitizing narratives that exceed a safe nesting depth, such as 50 levels.
  • Deploy monitoring for repeated StackOverflow errors and, if feasible, interrupt the inbound FHIR payload before it reaches the parser.

Generated by OpenCVE AI on August 7, 2026 at 21:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 07 Aug 2026 20:15:00 +0000

Type Values Removed Values Added
Description HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, XhtmlParser.java imposes no maximum element nesting depth, so a deeply nested text.div narrative triggers unbounded recursion between parseElementInner() and parseElement(), raising a StackOverflowError. An attacker who can submit FHIR resources containing such narratives can thus crash a parsing or validation worker thread, affecting validator services and any application that parses attacker-supplied FHIR JSON or XML. This issue is fixed in version 6.9.11.
Title HAPI FHIR: XHTML narrative parser unbounded recursion causes StackOverflow denial of service
Weaknesses CWE-20
CWE-400
CWE-674
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-07T20:03:17.024Z

Reserved: 2026-07-13T18:37:08.488Z

Link: CVE-2026-62296

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-07T21:30:18Z

Weaknesses
  • CWE-20

    Improper Input Validation

  • CWE-400

    Uncontrolled Resource Consumption

  • CWE-674

    Uncontrolled Recursion