EUVD-2026-54643Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable with no authentication or preconditions required; impact is exclusively availability via unrecoverable thread crash with no data exposure.
Primary rating from Vendor (github).
CVSS VectorVendor: github
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
4DescriptionCVE.org
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, XhtmlParser.java imposes no maximum element nesting depth, so a deeply nested text.div narrative triggers unbounded recursion between parseElementInner() and parseElement(), raising a StackOverflowError. An attacker who can submit FHIR resources containing such narratives can thus crash a parsing or validation worker thread, affecting validator services and any application that parses attacker-supplied FHIR JSON or XML. This issue is fixed in version 6.9.11.
Articles & Coverage 1
AnalysisAI
Denial-of-service via unbounded recursion in HAPI FHIR prior to 6.9.11 allows an unauthenticated remote attacker to crash parsing and validation worker threads by submitting FHIR resources containing deeply nested XHTML narratives, JSON objects, or XML elements. The commit diff reveals the flaw spans three parsers - XhtmlParser, JsonParser, and XMLUtil - each lacking a nesting depth guard, so crafted input triggers mutual recursion that exhausts the JVM thread stack and raises an unrecoverable StackOverflowError. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target must be running HAPI FHIR org.hl7.fhir.core prior to version 6.9.11 and must expose an endpoint that parses attacker-supplied FHIR JSON or XML - including $validate operations or any application that accepts FHIR resource submissions from external parties. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.5 HIGH score is well-grounded: AV:N (network-reachable endpoint), AC:L (no special conditions), PR:N (unauthenticated), UI:N (no user interaction required), and A:H (complete availability loss for the affected thread). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker sends an unauthenticated HTTP POST to a public FHIR $validate endpoint with a FHIR JSON Patient resource whose top-level JSON array or text.div element is nested 600 or more levels deep, far exceeding the JVM thread stack capacity for the mutual recursion in JsonParser or XhtmlParser. The handling worker thread raises an unrecoverable StackOverflowError and terminates; if requests arrive at a rate matching thread pool replenishment, all worker threads can be exhausted, taking the FHIR service offline. … |
| Remediation | Upgrade to HAPI FHIR org.hl7.fhir.core version 6.9.11 or later, which enforces a maximum nesting depth of 500 elements in both XhtmlParser and JsonParser, and a JAXP maxElementDepth of 1000 in XMLUtil, ensuring that oversized inputs fail with a clean FHIRFormatError or JsonException rather than an unrecoverable StackOverflowError. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct an inventory of all HAPI FHIR deployments documenting versions and network exposure, then immediately implement strict input validation limiting FHIR resource nesting depth and payload size to prevent recursive parser exhaustion. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Same weakness CWE-20 – Improper Input Validation
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today