CVE-2026-62296 in HAPI FHIR
Summary
by MITRE • 08/07/2026
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, XhtmlParser.java imposes no maximum element nesting depth, so a deeply nested text.div narrative triggers unbounded recursion between parseElementInner() and parseElement(), raising a StackOverflowError. An attacker who can submit FHIR resources containing such narratives can thus crash a parsing or validation worker thread, affecting validator services and any application that parses attacker-supplied FHIR JSON or XML. This issue is fixed in version 6.9.11.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/07/2026
The HAPI FHIR library represents a comprehensive Java implementation of the HL7 FHIR standard, designed to facilitate healthcare data interoperability through standardized messaging formats. This widely adopted framework enables healthcare applications to exchange patient information, clinical data, and other medical records using structured XML or JSON representations. The vulnerability affects versions prior to 6.9.11 where the XhtmlParser.java component lacks proper recursion depth controls during the parsing of FHIR resource narratives. The specific flaw manifests in the parsing logic where text.div elements within FHIR resources can trigger unbounded recursive calls between parseElementInner() and parseElement() methods, ultimately leading to StackOverflowError conditions that terminate worker threads processing these resources.
The technical implementation of this vulnerability stems from inadequate input validation and recursion control mechanisms within the HTML parsing component of HAPI FHIR. When malformed or maliciously constructed FHIR resources contain deeply nested XHTML content within narrative elements, the parser enters an infinite recursive loop without proper depth limitations. This recursive behavior occurs because the parser does not enforce maximum nesting levels during element processing, allowing attackers to craft payloads that exponentially increase stack consumption with each additional nesting level. The vulnerability specifically affects both JSON and XML parsing pathways since the XhtmlParser component handles narrative content regardless of serialization format, making it a comprehensive issue across the library's supported input types.
Operational impact of this vulnerability extends beyond simple service disruption to encompass broader system stability and availability concerns within healthcare applications. An attacker capable of submitting malicious FHIR resources can induce denial-of-service conditions by exhausting worker thread stack spaces, effectively crashing parsing or validation services that depend on HAPI FHIR. This affects not only standalone validation tools but also integrated healthcare systems where FHIR parsing is a core functional component. The vulnerability creates a potential attack surface where untrusted input processing can lead to complete service exhaustion, particularly in high-throughput environments where multiple concurrent parsing operations occur. Applications that parse external FHIR data from various sources become vulnerable to this class of attack, potentially impacting critical healthcare workflows and patient data processing capabilities.
The vulnerability aligns with CWE-674 (Uncontrolled Recursion) and represents a classic example of insufficient input validation leading to resource exhaustion attacks. From an ATT&CK framework perspective, this maps to T1499.004 (Endpoint Denial of Service) and potentially T1595.001 (Network Device Firmware) if the vulnerability affects networked healthcare devices that process FHIR data. Mitigation strategies should focus on implementing proper recursion depth limits within the XhtmlParser component, establishing maximum nesting thresholds for HTML elements during FHIR parsing operations, and deploying input validation controls to prevent excessively nested content from reaching the vulnerable parser methods. Organizations should also implement monitoring for unusual parsing patterns and establish rate limiting mechanisms to prevent exploitation of this vulnerability through repeated malicious submissions, while upgrading to version 6.9.11 or later to eliminate the root cause of the issue.
This vulnerability demonstrates the critical importance of recursion control in healthcare interoperability frameworks where untrusted data processing is common. The attack vector requires only the ability to submit FHIR resources, making it particularly dangerous in environments where external data sources feed into critical healthcare applications. The fix implemented in version 6.9.11 addresses the core issue by introducing proper maximum nesting depth controls that prevent the infinite recursion scenario while maintaining compatibility with legitimate FHIR content. Security teams should conduct thorough testing of their HAPI FHIR implementations to verify proper upgrade completion and ensure that all parsing paths properly enforce recursion limits to prevent similar issues in other components of the healthcare data processing pipeline.