Description
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, XhtmlParser.java imposes no maximum element nesting depth, so a deeply nested text.div narrative triggers unbounded recursion between parseElementInner() and parseElement(), raising a StackOverflowError. An attacker who can submit FHIR resources containing such narratives can thus crash a parsing or validation worker thread, affecting validator services and any application that parses attacker-supplied FHIR JSON or XML. This issue is fixed in version 6.9.11.
Published: 2026-08-07
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability resides in HAPI FHIR’s XHTML parser, which accepts arbitrarily deep element nesting. A maliciously crafted FHIR resource can trigger unbounded recursion, leading the parser to raise a StackOverflowError. The resulting crash disables the parsing or validation worker thread, causing a denial of service for applications that process attacker supplied FHIR JSON or XML.

Affected Systems

Affecting the HAPI FHIR core library (org.hl7.fhir.core) and related components (org.hl7.fhir.r5, org.hl7.fhir.utilities, org.hl7.fhir.validation, org.hl7.fhir.validation.cli) in any installation running a pre‑6.9.11 version. Any application or service that uses these libraries to parse or validate incoming FHIR resources is susceptible.

Risk and Exploitability

With a CVSS score of 7.5 the flaw is considered High. The EPSS score is not available, and the vulnerability is not listed in CISA KEV catalog. An attacker who can submit FHIR resources, for example through a publicly exposed API or ingestion service, can exploit the flaw remotely by uploading a deeply nested narrative, leading to service disruption.

Generated by OpenCVE AI on August 7, 2026 at 21:25 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to HAPI FHIR version 6.9.11 or later.
  • If an immediate upgrade is impossible, restrict input by rejecting or sanitizing narratives that exceed a safe nesting depth, such as 50 levels.
  • Deploy monitoring for repeated StackOverflow errors and, if feasible, interrupt the inbound FHIR payload before it reaches the parser.

Generated by OpenCVE AI on August 7, 2026 at 21:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 10 Aug 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 08 Aug 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Hapifhir
Hapifhir hl7 Fhir Core
Vendors & Products Hapifhir
Hapifhir hl7 Fhir Core

Fri, 07 Aug 2026 20:15:00 +0000

Type Values Removed Values Added
Description HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, XhtmlParser.java imposes no maximum element nesting depth, so a deeply nested text.div narrative triggers unbounded recursion between parseElementInner() and parseElement(), raising a StackOverflowError. An attacker who can submit FHIR resources containing such narratives can thus crash a parsing or validation worker thread, affecting validator services and any application that parses attacker-supplied FHIR JSON or XML. This issue is fixed in version 6.9.11.
Title HAPI FHIR: XHTML narrative parser unbounded recursion causes StackOverflow denial of service
Weaknesses CWE-20
CWE-400
CWE-674
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Hapifhir Hl7 Fhir Core
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-10T13:29:55.958Z

Reserved: 2026-07-13T18:37:08.488Z

Link: CVE-2026-62296

cve-icon Vulnrichment

Updated: 2026-08-10T13:29:51.882Z

cve-icon NVD

Status : Received

Published: 2026-08-07T20:16:52.457

Modified: 2026-08-10T14:17:25.343

Link: CVE-2026-62296

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-08T20:45:17Z

Weaknesses
  • CWE-20

    Improper Input Validation

  • CWE-400

    Uncontrolled Resource Consumption

  • CWE-674

    Uncontrolled Recursion