Stack Overflow Vulnerability in HAPI FHIR Java Implementation for Healthcare Data
CVE-2026-62296

7.5HIGH

Key Information:

Vendor

Hapifhir

Status
Org.hl7.fhir.core
Ca.uhn.hapi.fhir:org.hl7.fhir.r5
Ca.uhn.hapi.fhir:org.hl7.fhir.utilities
Ca.uhn.hapi.fhir:org.hl7.fhir.validation
Vendor
CVE Published:
7 August 2026

What is CVE-2026-62296?

A vulnerability in HAPI FHIR's XhtmlParser allows for unbounded recursion due to an absence of maximum element nesting depth. This issue can be exploited by attackers by submitting FHIR resources with deeply nested narratives, leading to StackOverflowError and potentially crashing parsing or validation worker threads. This vulnerability affects any application that processes maliciously crafted FHIR JSON or XML, disrupting validator services. The issue was addressed in version 6.9.11.

Affected Version(s)

ca.uhn.hapi.fhir:org.hl7.fhir.r5 < 6.9.11

ca.uhn.hapi.fhir:org.hl7.fhir.utilities < 6.9.11

ca.uhn.hapi.fhir:org.hl7.fhir.validation < 6.9.11

References

https://github.com/hapifhir/org.hl7.fhir.core/security/ad...
x_refsource_CONFIRM
https://github.com/hapifhir/org.hl7.fhir.core/commit/396f...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.