HAPI FHIR CVE-2026-62296

The target must be running HAPI FHIR org.hl7.fhir.core prior to version 6.9.11 and must expose an endpoint that parses attacker-supplied FHIR JSON or XML - including $validate operations or any application that accepts FHIR resource submissions from external parties. Per the CVSS vector PR:N, no authentication is required, and exploitation succeeds against unauthenticated HTTP endpoints in the default configuration. No special FHIR feature flag or non-default setting is needed - the vulnerability exists in the core parsing paths for all three supported formats (XHTML, JSON, XML). Exploitation is strictly bounded to availability impact: no confidentiality or integrity compromise is possible. Deployments that parse only internally-generated FHIR resources from trusted systems, or that enforce authentication before accepting any FHIR resource, are not exposed to this attack vector.

The CVSS 7.5 HIGH score is well-grounded: AV:N (network-reachable endpoint), AC:L (no special conditions), PR:N (unauthenticated), UI:N (no user interaction required), and A:H (complete availability loss for the affected thread). Real-world risk is meaningful for healthcare organizations running HAPI FHIR validator services or applications that ingest FHIR resources from external parties, as a single malformed request can permanently crash the handling worker thread. Impact is strictly limited to availability - C:N/I:N - meaning there is no data exfiltration or integrity risk. EPSS data was not provided in the input and cannot be stated. The vulnerability is not listed in the CISA KEV catalog, and no POC has been identified at time of analysis, which moderates urgency relative to a KEV-listed flaw. However, the exploitation mechanics are trivial - crafting a deeply nested JSON array or XML document requires no special tooling - meaning exploitation probability will rise significantly if POC code is published. Patch availability in 6.9.11 means remediation is straightforward, and the risk window should be short for organizations with active patch management.

An attacker sends an unauthenticated HTTP POST to a public FHIR $validate endpoint with a FHIR JSON Patient resource whose top-level JSON array or text.div element is nested 600 or more levels deep, far exceeding the JVM thread stack capacity for the mutual recursion in JsonParser or XhtmlParser. The handling worker thread raises an unrecoverable StackOverflowError and terminates; if requests arrive at a rate matching thread pool replenishment, all worker threads can be exhausted, taking the FHIR service offline. No POC code has been identified at time of analysis, but constructing such a payload requires only a simple script that concatenates opening JSON brackets or XML tags.