CVE-2026-62295
Received Received - Intake

Stack Overflow Error in HAPI FHIR JSON Parser

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: GitHub, Inc.

Description
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, the JSON utility parser in org.hl7.fhir.utilities.json.parser.JsonParser enforces no maximum nesting depth for arrays or objects. As a result, a small but deeply nested, syntactically valid FHIR JSON document can trigger unbounded readArray() or readObject() recursion, raising a StackOverflowError before structural validation runs. An attacker who can submit JSON resources for validation can thus crash the request thread, and services that do not isolate StackOverflowError safely may experience worker loss or process instability — a denial-of-service condition. This issue is fixed in version 6.9.11.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-07
Last Modified
2026-08-07
Generated
2026-08-08
AI Q&A
2026-08-07
EPSS Evaluated
N/A
NVD
CVE-2026-62295
EUVD
EUVD-2026-54639

Affected Vendors & Products

Showing 7 associated CPEs
Vendor Product Version / Range
hapifhir org.hl7.fhir.core to 6.9.11 (exc)
hapifhir org.hl7.fhir.core 6.9.11
hapifhir org.hl7.fhir.r5 *
hapifhir org.hl7.fhir.utilities *
hapifhir org.hl7.fhir.validation *
hapifhir org.hl7.fhir.validation.cli *
hapifhir hapi_fhir 6.9.11

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-674 The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a denial-of-service issue in HAPI FHIR's JSON parser. Prior to version 6.9.11, the parser did not limit nesting depth for JSON arrays or objects. A deeply nested but valid FHIR JSON document could cause unbounded recursion, leading to a StackOverflowError before validation. This crashes the request thread and may cause worker loss or process instability in services that don't handle such errors safely.

Detection Guidance

To detect this vulnerability, check if your HAPI FHIR version is below 6.9.11. Use commands like 'mvn dependency:tree' in Java projects to verify the version. Monitor for StackOverflowError exceptions in logs when processing FHIR JSON resources.

Impact Analysis

An attacker could exploit this by submitting a specially crafted JSON resource to crash the FHIR service. This may lead to service unavailability, worker thread loss, or process instability. Systems relying on HAPI FHIR versions before 6.9.11 are vulnerable to this denial-of-service attack.

Compliance Impact

This vulnerability could impact compliance by causing service disruptions or unavailability, potentially violating availability requirements in GDPR and HIPAA. Unplanned downtime may lead to breaches of service level agreements or regulatory obligations for data accessibility and integrity.

Mitigation Strategies

Upgrade to HAPI FHIR version 6.9.11 or later immediately. If upgrading is not possible, implement input validation to reject deeply nested JSON structures before parsing. Configure thread isolation to prevent worker loss from StackOverflowError.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-62295. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart