CVE-2026-62296 Details
Description
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, XhtmlParser.java imposes no maximum element nesting depth, so a deeply nested text.div narrative triggers unbounded recursion between parseElementInner() and parseElement(), raising a StackOverflowError. An attacker who can submit FHIR resources containing such narratives can thus crash a parsing or validation worker thread, affecting validator services and any application that parses attacker-supplied FHIR JSON or XML. This issue is fixed in version 6.9.11.
A denial-of-service vulnerability has been identified in HAPI FHIR versions through 6.9.10. The issue arises in the XHTML parser, which lacks a maximum element nesting depth. This oversight allows deeply nested narratives to cause unbounded recursion, leading to a StackOverflowError. As a result, a parsing or validation worker thread can be crashed, disrupting validator services and applications that process FHIR JSON or XML resources.
Users can upgrade to HAPI FHIR version 6.9.11 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 7, 2026CISA-ADP
Assessed Aug 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-5v24-q6x8-hc38 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/hapifhir/org.hl7.fhir.core/commit/396f447500407693d6ae1e64db59782862ca7506 | [email protected] | Source CodeVendor |
| https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-5v24-q6x8-hc38 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-20 | Improper Input Validation | [email protected] |
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
| CWE-674 | Uncontrolled Recursion | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| HAPI FHIR | <= 6.9.10 (semver) |
CPE
Remediation
| |
| ca.uhn.hapi.fhir | All versions |
CPE
Remediation
| |
| ca.uhn.hapi.fhir.utilities | All versions |
CPE
Remediation
| |
| ca.uhn.hapi.fhir.validation | All versions |
CPE
Remediation
| |
| ca.uhn.hapi.fhir.validation.cli | All versions |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 10, 2026 | CVE Modified | CISA-ADP |
| Aug 7, 2026 | New CVE Received | [email protected] |