Vulnerability · Published Aug 7, 2026 · Assigned by GitHub_M
CVE-2026-62295HAPI FHIR: JSON utility parser unbounded recursion causes StackOverflow denial of service
High 7.5
In plain English
A high-severity improper input validation in ca.uhn.hapi.fhir:org.hl7.fhir.r5 from hapifhir. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).
Official description
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, the JSON utility parser in org.hl7.fhir.utilities.json.parser.JsonParser enforces no maximum nesting depth for arrays or objects. As a result, a small but deeply nested, syntactically valid FHIR JSON document can trigger unbounded readArray() or readObject() recursion, raising a StackOverflowError before structural validation runs. An attacker who can submit JSON resources for validation can thus crash the request thread, and services that do not isolate StackOverflowError safely may experience worker loss or process instability — a denial-of-service condition. This issue is fixed in version 6.9.11.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| hapifhir | org.hl7.fhir.core | < 6.9.11 |
| hapifhir | ca.uhn.hapi.fhir:org.hl7.fhir.r5 | < 6.9.11 |
| hapifhir | ca.uhn.hapi.fhir:org.hl7.fhir.utilities | < 6.9.11 |
| hapifhir | ca.uhn.hapi.fhir:org.hl7.fhir.validation | < 6.9.11 |
| hapifhir | ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli | < 6.9.11 |
Weakness: CWE-20, CWE-400, CWE-674 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H