CVE-2026-62296
Received Received - Intake

Stack Overflow in HAPI FHIR Java Library

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: GitHub, Inc.

Description
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, XhtmlParser.java imposes no maximum element nesting depth, so a deeply nested text.div narrative triggers unbounded recursion between parseElementInner() and parseElement(), raising a StackOverflowError. An attacker who can submit FHIR resources containing such narratives can thus crash a parsing or validation worker thread, affecting validator services and any application that parses attacker-supplied FHIR JSON or XML. This issue is fixed in version 6.9.11.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-07
Last Modified
2026-08-07
Generated
2026-08-08
AI Q&A
2026-08-07
EPSS Evaluated
N/A
NVD
CVE-2026-62296
EUVD
EUVD-2026-54643

Affected Vendors & Products

Showing 7 associated CPEs
Vendor Product Version / Range
hapifhir hapi_fhir 6.9.11
hapifhir hapi_fhir From 6.9.11 (inc)
hapifhir org.hl7.fhir.r5 6.9.11
hapifhir org.hl7.fhir.utilities 6.9.11
hapifhir org.hl7.fhir.validation 6.9.11
hapifhir org.hl7.fhir.validation.cli 6.9.11
hapi_fhir hapi_fhir to 6.9.11 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-674 The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-62296 is a denial-of-service vulnerability in HAPI FHIR where the XHTML parser lacks a maximum nesting depth limit. This allows deeply nested XHTML structures in FHIR resources to cause unbounded recursion between parseElement() and parseElementInner(), leading to a StackOverflowError and crashing parsing or validation threads.

Detection Guidance

Monitor for StackOverflowError exceptions in HAPI FHIR parsing or validation threads. Check logs for crashes in services handling FHIR resources. Test with deeply nested XHTML narratives to see if parsing fails.

Impact Analysis

An attacker can submit a FHIR resource with a deeply nested XHTML narrative to crash validator services or applications parsing attacker-supplied FHIR JSON/XML. This disrupts availability by denying service to threads processing these resources.

Compliance Impact

This vulnerability primarily impacts availability by crashing FHIR parsing threads, which could disrupt healthcare services processing FHIR resources. While not directly violating GDPR or HIPAA, such disruptions may affect compliance by impairing access to protected health information (PHI) during outages, potentially violating HIPAA's availability requirements for PHI access. GDPR compliance could also be indirectly impacted if patient data processing is interrupted.

Mitigation Strategies

Upgrade HAPI FHIR to version 6.9.11 or later. If upgrading is not possible, restrict access to FHIR resource parsing endpoints to trusted sources only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-62296. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart