CVE-2026-62295 Details
Description
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, the JSON utility parser in org.hl7.fhir.utilities.json.parser.JsonParser enforces no maximum nesting depth for arrays or objects. As a result, a small but deeply nested, syntactically valid FHIR JSON document can trigger unbounded readArray() or readObject() recursion, raising a StackOverflowError before structural validation runs. An attacker who can submit JSON resources for validation can thus crash the request thread, and services that do not isolate StackOverflowError safely may experience worker loss or process instability — a denial-of-service condition. This issue is fixed in version 6.9.11.
A denial-of-service vulnerability has been identified in HAPI FHIR versions through 6.9.10. The issue arises in the JSON utility parser, where there is no maximum nesting depth enforced for arrays or objects. This lack of restriction allows a small but deeply nested, syntactically valid FHIR JSON document to cause unbounded recursion in the parsing process. As a result, a StackOverflowError is triggered, crashing the request thread before proper structural validation can take place. This vulnerability can lead to process instability or loss of worker threads in services that do not handle StackOverflowErrors appropriately.
Users can upgrade to HAPI FHIR version 6.9.11 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 7, 2026CISA-ADP
Assessed Aug 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-2cq7-hg49-56gc | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/hapifhir/org.hl7.fhir.core/commit/396f447500407693d6ae1e64db59782862ca7506 | [email protected] | Source CodeVendor |
| https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-2cq7-hg49-56gc | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-20 | Improper Input Validation | [email protected] |
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
| CWE-674 | Uncontrolled Recursion | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| HAPI FHIR | <= 6.9.10 (semver) |
CPE
Remediation
| |
| ca.uhn.hapi.fhir.org.hl7.fhir.r5 | All versions |
CPE
Remediation
| |
| ca.uhn.hapi.fhir.org.hl7.fhir.utilities | All versions |
CPE
Remediation
| |
| ca.uhn.hapi.fhir.org.hl7.fhir.validation | All versions |
CPE
Remediation
| |
| ca.uhn.hapi.fhir.org.hl7.fhir.validation.cli | All versions |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 13, 2026 | CVE Modified | CISA-ADP |
| Aug 7, 2026 | New CVE Received | [email protected] |