CVE-2026-62296: HAPI FHIR DoS Vulnerability

CVE-2026-62296 Overview

CVE-2026-62296 is a denial-of-service vulnerability in HAPI FHIR, a Java implementation of the HL7 Fast Healthcare Interoperability Resources (FHIR) standard. The flaw resides in XhtmlParser.java, which imposes no maximum element nesting depth when parsing the text.div narrative section of FHIR resources. A deeply nested XHTML payload triggers unbounded mutual recursion between parseElementInner() and parseElement(), exhausting the thread stack and raising a StackOverflowError. Any application that parses attacker-supplied FHIR JSON or XML, including validator services, is affected. The issue is fixed in version 6.9.11.

Critical Impact
A remote unauthenticated attacker can crash parsing or validation worker threads by submitting a single crafted FHIR resource, disrupting healthcare interoperability services.

Affected Products

HAPI FHIR (org.hl7.fhir.core) versions prior to 6.9.11
FHIR validator services built on the affected library
Java applications parsing attacker-supplied FHIR JSON or XML

Discovery Timeline

2026-08-07 - CVE-2026-62296 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-62296

Vulnerability Analysis

The vulnerability is classified as improper input validation [CWE-20] and manifests as an algorithmic denial of service. HAPI FHIR resources include a mandatory text.div narrative element containing XHTML content. The XhtmlParser walks this content recursively, with parseElementInner() calling parseElement() for each child node. Neither function tracks or limits nesting depth. When an attacker submits a resource whose narrative contains hundreds or thousands of nested elements, the JVM exhausts its call stack and throws StackOverflowError, terminating the worker thread handling the request. The same recursive pattern exists in the JSON parser, where readObject() and readArray() recurse into each other without depth accounting.

Root Cause

The root cause is the absence of a depth guard on mutually recursive descent parsers. Java threads have a bounded stack size, and unbounded structural recursion on attacker-controlled input reliably produces a fatal error. FHIR narratives are user-supplied XHTML fragments, so the parser must treat their structure as untrusted.

Attack Vector

An attacker submits a FHIR resource with a text.div value containing deeply nested tags such as <div><div><div>...</div></div></div>. When the target service parses or validates the resource, the recursive descent overflows the stack. No authentication or user interaction is required, and the attack is delivered over the network as a normal FHIR payload.

java

// Patch applied to XhtmlParser.java
   public static final String XHTML_NS = "http://www.w3.org/1999/xhtml";
   private static final char END_OF_CHARS = (char) -1;
   private static final boolean DEBUG = false;
+  // maximum XHTML element nesting depth; well above any legitimate FHIR narrative, but low
+  // enough to fail cleanly with a FHIRFormatError rather than a StackOverflowError.
+  private static final int MAX_XHTML_DEPTH = 500;

// Companion patch applied to JsonParser.java
   enum ItemType {
     Object, String, Number, Boolean, Array, End, Eof, Null;
   }
+  private static final int MAX_JSON_DEPTH = 500;
+  private int parseDepth = 0;

Source: GitHub commit 396f447

Detection Methods for CVE-2026-62296

Indicators of Compromise

StackOverflowError entries in application logs referencing XhtmlParser.parseElement or XhtmlParser.parseElementInner frames.
StackOverflowError traces referencing JsonParser.readObject or JsonParser.readArray from org.hl7.fhir.utilities.json.parser.
Sudden termination of FHIR validator or parser worker threads following inbound resource submissions.

Detection Strategies

Inspect inbound FHIR payloads for text.div narrative sections containing abnormal element nesting, particularly repeated identical tags exceeding a few dozen levels.
Correlate HTTP request bodies larger than expected with subsequent JVM stack traces to identify malicious submissions.
Enable structured logging on the FHIR endpoint to capture the source IP and resource type associated with any parse failure.

Monitoring Recommendations

Alert on repeated StackOverflowError or FHIRFormatError events from the parsing tier within short time windows.
Track worker thread restart frequency and per-endpoint error rates for FHIR ingestion services.
Monitor JVM thread-death metrics from application performance monitoring tools tied to the FHIR service.

How to Mitigate CVE-2026-62296

Immediate Actions Required

Upgrade org.hl7.fhir.core to version 6.9.11 or later across all services that parse or validate FHIR resources.
Audit dependency trees for transitive inclusion of vulnerable HAPI FHIR versions in downstream applications.
Restart affected services after upgrade to ensure the patched parser classes are loaded.

Patch Information

The fix, committed in 396f447, introduces a MAX_XHTML_DEPTH constant of 500 in XhtmlParser and a MAX_JSON_DEPTH constant of 500 in JsonParser. When a payload exceeds these limits, the parser now raises FHIRFormatError or JsonException instead of allowing recursion to overflow the stack. Details are documented in GHSA-5v24-q6x8-hc38.

Workarounds

Enforce request body size limits at the reverse proxy or API gateway to reduce the feasibility of deeply nested payloads.
Add a pre-parse validation step that rejects narratives whose raw XHTML nesting depth exceeds an application-defined threshold.
Isolate FHIR parsing in dedicated worker processes so that a StackOverflowError does not terminate the primary service.

bash

# Update Maven dependency to the patched release
mvn versions:use-dep-version -Dincludes=ca.uhn.hapi.fhir:org.hl7.fhir.core -DdepVersion=6.9.11 -DforceVersion=true