CVE-2026-62295: HAPI FHIR JSON Parser DoS Vulnerability

CVE-2026-62295 Overview

CVE-2026-62295 is a denial-of-service vulnerability in HAPI FHIR, a Java implementation of the HL7 FHIR standard for healthcare interoperability. The JsonParser class in org.hl7.fhir.utilities.json.parser enforces no maximum nesting depth for JSON arrays or objects. A small but deeply nested, syntactically valid FHIR JSON document can trigger unbounded recursion between readArray() and readObject(), raising a StackOverflowError before structural validation runs. An attacker who can submit JSON resources for validation can crash the request thread. Services that do not isolate StackOverflowError safely may experience worker loss or process instability. The issue is resolved in version 6.9.11.

Critical Impact

Unauthenticated attackers can crash validation worker threads and destabilize HAPI FHIR services by submitting deeply nested JSON payloads, disrupting healthcare interoperability workflows.

Affected Products

• HAPI FHIR org.hl7.fhir.core versions prior to 6.9.11
• Applications embedding the vulnerable JsonParser for FHIR resource validation
• Downstream services exposing FHIR JSON endpoints without hardened error isolation

Discovery Timeline

• 2026-08-07 - CVE-2026-62295 published to NVD
• 2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-62295

Vulnerability Analysis

The flaw resides in the JSON utility parser at org.hl7.fhir.utilities.json.parser.JsonParser. The parser implements standard JSON grammar using mutually recursive descent, where readObject() invokes readArray() when it encounters a nested array value, and vice versa. Prior to 6.9.11, neither method tracked parse depth or enforced a ceiling. An attacker constructs a valid FHIR JSON document containing hundreds or thousands of nested arrays or objects. Each nesting level consumes a Java stack frame. When the JVM stack limit is exhausted, the parser throws a StackOverflowError before the FHIR structural validator ever inspects the payload. This categorizes as improper input validation [CWE-20] leading to resource exhaustion. Because HAPI FHIR is widely deployed as a validation gateway in electronic health record integrations, a single crafted request can degrade healthcare data exchange availability.

Root Cause

The JsonParser lacked a nesting-depth guard on the recursive call chain between readObject() and readArray(). Without a depth counter, the parser trusted the JVM stack to bound recursion, which fails on adversarial input long before structural or schema validation runs.

Attack Vector

The vulnerability is exploitable over the network without authentication or user interaction. Any endpoint that accepts a FHIR JSON resource and routes it through JsonParser is a viable target. The attacker submits a compact payload of deeply nested [[[...]]] or {"a":{"a":...}} structures. StackOverflowError is an Error, not a RuntimeException, so frameworks that catch only Exception may leave the worker thread or process in an unrecoverable state.

  enum ItemType {
    Object, String, Number, Boolean, Array, End, Eof, Null;
  }
+ // maximum object/array nesting depth; well above any legitimate FHIR resource, but low enough
+ // to fail cleanly with a JsonException rather than a StackOverflowError on the mutual recursion
+ // between readObject() and readArray().
+ private static final int MAX_JSON_DEPTH = 500;
+ private int parseDepth = 0;

  private JsonLexer lexer;
  private ItemType itemType = ItemType.Object;
  private String itemName;

Source: GitHub Commit 396f4475

Detection Methods for CVE-2026-62295

Indicators of Compromise

• FHIR JSON validation endpoints logging java.lang.StackOverflowError with stack traces referencing JsonParser.readArray or JsonParser.readObject
• Abnormal worker thread termination or application server restarts correlated with inbound /fhir/* POST or PUT requests
• Inbound JSON payloads with unusually high bracket-nesting ratios relative to payload size

Detection Strategies

• Inspect application logs for repeated StackOverflowError events originating in org.hl7.fhir.utilities.json.parser.JsonParser
• Deploy WAF or API gateway rules that count consecutive [ or { characters in request bodies and flag payloads exceeding a safe threshold (for example, 500)
• Correlate HTTP 5xx spikes on FHIR endpoints with source IPs sending small but structurally anomalous JSON bodies

Monitoring Recommendations

• Track JVM thread count and pool saturation metrics on services embedding HAPI FHIR
• Alert on Error-level throwables in FHIR validation code paths, not just Exception
• Baseline typical FHIR resource nesting depth in production traffic to identify outliers

How to Mitigate CVE-2026-62295

Immediate Actions Required

• Upgrade org.hl7.fhir.core to version 6.9.11 or later across all services performing FHIR JSON validation
• Audit application code to ensure worker threads recover safely from Error throwables, not only Exception
• Restrict maximum request body size on FHIR endpoints to reduce the attack surface for nested payloads

Patch Information

The fix introduces a MAX_JSON_DEPTH constant of 500 and a parseDepth counter in JsonParser, causing the parser to raise a JsonException before recursion exhausts the stack. A parallel fix in XhtmlParser adds MAX_XHTML_DEPTH to guard XHTML narrative parsing. See the GitHub Security Advisory GHSA-2cq7-hg49-56gc and the remediation commit.

  public static final String XHTML_NS = "http://www.w3.org/1999/xhtml";
  private static final char END_OF_CHARS = (char) -1;
  private static final boolean DEBUG = false;
+ // maximum XHTML element nesting depth; well above any legitimate FHIR narrative, but low
+ // enough to fail cleanly with a FHIRFormatError rather than a StackOverflowError.
+ private static final int MAX_XHTML_DEPTH = 500;

  public class NamespaceNormalizationMap {

Source: GitHub Commit 396f4475

Workarounds

• Place a reverse proxy or API gateway in front of FHIR endpoints and reject JSON bodies whose nesting depth exceeds a conservative threshold
• Enforce request size limits and rate-limit anonymous submitters of FHIR validation requests
• Wrap JsonParser.parse() invocations in code that catches StackOverflowError and returns a controlled error response, isolating the worker thread

# Example: enforce upstream body size limit in nginx before FHIR service
location /fhir/ {
    client_max_body_size 256k;
    proxy_pass http://hapi_fhir_backend;
}