{"id":"CVE-2026-62295","summary":"HAPI FHIR: JSON utility parser unbounded recursion causes StackOverflow denial of service","details":"HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, the JSON utility parser in org.hl7.fhir.utilities.json.parser.JsonParser enforces no maximum nesting depth for arrays or objects. As a result, a small but deeply nested, syntactically valid FHIR JSON document can trigger unbounded readArray() or readObject() recursion, raising a StackOverflowError before structural validation runs. An attacker who can submit JSON resources for validation can thus crash the request thread, and services that do not isolate StackOverflowError safely may experience worker loss or process instability — a denial-of-service condition. This issue is fixed in version 6.9.11.","aliases":["GHSA-2cq7-hg49-56gc"],"modified":"2026-08-09T08:32:44.646583Z","published":"2026-08-07T19:36:31.274Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/62xxx/CVE-2026-62295.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-20","CWE-400","CWE-674"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/62xxx/CVE-2026-62295.json"},{"type":"ADVISORY","url":"https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-2cq7-hg49-56gc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62295"},{"type":"FIX","url":"https://github.com/hapifhir/org.hl7.fhir.core/commit/396f447500407693d6ae1e64db59782862ca7506"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/hapifhir/org.hl7.fhir.core","events":[{"introduced":"0"},{"fixed":"396f447500407693d6ae1e64db59782862ca7506"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"6.9.11"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["6.9.9","6.9.8","6.9.4","6.9.7","6.9.6","6.9.5","6.9.3","6.9.2","6.9.1","6.9.0","6.8.1","6.8.2","6.7.11"],"database_specific":{"vanir_signatures_modified":"2026-08-09T08:32:44Z","vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"198859985819541875461976648171601804986","length":746},"id":"CVE-2026-62295-050dc0e8","signature_type":"Function","signature_version":"v1","source":"https://github.com/hapifhir/org.hl7.fhir.core/commit/396f447500407693d6ae1e64db59782862ca7506","target":{"file":"org.hl7.fhir.utilities/src/main/java/org/hl7/fhir/utilities/xhtml/XhtmlParser.java","function":"parseElement"}},{"target":{"file":"org.hl7.fhir.utilities/src/main/java/org/hl7/fhir/utilities/json/parser/JsonParser.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["79593679323901234110806024549928524211","12171244668519292412350463326027559432","78139065511233308537018699900946059830","271280053717451113443881252728527142181","91931524333809736195623035587954405005","83663460041646696610510156311985593340","89113023621798937282809023164912680964","298669730936968119777089306350241553607","285906449065287154892712533965108023130","265495101296212854304193888771767767146","170318552977827958800230660667614685728","141306378708815001905238720347290518418","232814005972718999626852576271585831333","241536062391576873690384311886961656565","257094436895162903951878926631728834214","337974831831435940241070616805758588933","261068351583908889740932730863809780068","328003151266302268216377876414578735823"]},"id":"CVE-2026-62295-33680024","signature_type":"Line","signature_version":"v1","source":"https://github.com/hapifhir/org.hl7.fhir.core/commit/396f447500407693d6ae1e64db59782862ca7506"},{"deprecated":false,"digest":{"line_hashes":["13231589082410998616365685922709632616","102248407972432671800141586969788703657","58242369192115067926082408900804893606","301491735343400043967550868323273342014","320128256822643681250572534090232739272"],"threshold":0.9},"id":"CVE-2026-62295-3abfabc0","signature_type":"Line","signature_version":"v1","source":"https://github.com/hapifhir/org.hl7.fhir.core/commit/396f447500407693d6ae1e64db59782862ca7506","target":{"file":"org.hl7.fhir.utilities/src/test/java/org/hl7/fhir/utilities/json/JsonParserTests.java"}},{"id":"CVE-2026-62295-44f621e2","signature_type":"Function","signature_version":"v1","source":"https://github.com/hapifhir/org.hl7.fhir.core/commit/396f447500407693d6ae1e64db59782862ca7506","target":{"file":"org.hl7.fhir.utilities/src/main/java/org/hl7/fhir/utilities/json/parser/JsonParser.java","function":"readArray"},"deprecated":false,"digest":{"function_hash":"218006484714243940955914628826294664168","length":2204}},{"deprecated":false,"digest":{"function_hash":"35726950358675232549253352331995444362","length":3175},"id":"CVE-2026-62295-54fba999","signature_type":"Function","signature_version":"v1","source":"https://github.com/hapifhir/org.hl7.fhir.core/commit/396f447500407693d6ae1e64db59782862ca7506","target":{"file":"org.hl7.fhir.utilities/src/main/java/org/hl7/fhir/utilities/json/parser/JsonParser.java","function":"readObject"}},{"digest":{"length":209,"function_hash":"35520321064570470507359246374186728444"},"id":"CVE-2026-62295-5fdd9581","signature_type":"Function","signature_version":"v1","source":"https://github.com/hapifhir/org.hl7.fhir.core/commit/396f447500407693d6ae1e64db59782862ca7506","target":{"function":"newXXEProtectedDocumentBuilderFactory","file":"org.hl7.fhir.utilities/src/main/java/org/hl7/fhir/utilities/xml/XMLUtil.java"},"deprecated":false},{"target":{"file":"org.hl7.fhir.utilities/src/main/java/org/hl7/fhir/utilities/xhtml/XhtmlParser.java"},"deprecated":false,"digest":{"line_hashes":["28838802855149614147529584437251595464","323939453019960865653565834576942864065","155558383782060358453598376366851350726","147439837033672902310103865135590737285","316711770153868033335353226530124984327","93864826724956475425925031477096236281","223135053556515163113599545016504480535","8446616386685384797574260227889190690"],"threshold":0.9},"id":"CVE-2026-62295-a2cbdf1c","signature_type":"Line","signature_version":"v1","source":"https://github.com/hapifhir/org.hl7.fhir.core/commit/396f447500407693d6ae1e64db59782862ca7506"},{"signature_version":"v1","source":"https://github.com/hapifhir/org.hl7.fhir.core/commit/396f447500407693d6ae1e64db59782862ca7506","target":{"file":"org.hl7.fhir.utilities/src/main/java/org/hl7/fhir/utilities/xml/XMLUtil.java"},"deprecated":false,"digest":{"line_hashes":["193554984397679089185588386282754542205","91840663784319101336071758970143744829","145747032202750657058505903630913301883","223380909278401252187967292611749332365","300895393451319590435396964487424932229","41862026528797901383007716048960227019","181585491487816371759828734239473175886","1938237679005044047773568861712989717","322619268632842818158735659998005683713","229967698371065612558801519908704778877"],"threshold":0.9},"id":"CVE-2026-62295-a715828a","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/hapifhir/org.hl7.fhir.core/commit/396f447500407693d6ae1e64db59782862ca7506","target":{"file":"org.hl7.fhir.utilities/src/test/java/org/hl7/fhir/utilities/xml/XMLUtilTests.java"},"deprecated":false,"digest":{"line_hashes":["8147395381292895751976343515503389015","34419926887613138659429650444376054918","180889054843296365292526630092911465173","250001890055181610984101712506911580893","209222007397681753887655297996991132327","180210433636926805637912275064666960626","241905620139451643786647800146803560606"],"threshold":0.9},"id":"CVE-2026-62295-e2ef3c35","signature_type":"Line"}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-62295.json"}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}