{"id":"CVE-2026-62296","summary":"HAPI FHIR: XHTML narrative parser unbounded recursion causes StackOverflow denial of service","details":"HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, XhtmlParser.java imposes no maximum element nesting depth, so a deeply nested text.div narrative triggers unbounded recursion between parseElementInner() and parseElement(), raising a StackOverflowError. An attacker who can submit FHIR resources containing such narratives can thus crash a parsing or validation worker thread, affecting validator services and any application that parses attacker-supplied FHIR JSON or XML. This issue is fixed in version 6.9.11.","aliases":["GHSA-5v24-q6x8-hc38"],"modified":"2026-08-09T08:05:11.698060Z","published":"2026-08-07T20:03:17.024Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/62xxx/CVE-2026-62296.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-20","CWE-400","CWE-674"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/62xxx/CVE-2026-62296.json"},{"type":"ADVISORY","url":"https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-5v24-q6x8-hc38"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62296"},{"type":"FIX","url":"https://github.com/hapifhir/org.hl7.fhir.core/commit/396f447500407693d6ae1e64db59782862ca7506"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/hapifhir/org.hl7.fhir.core","events":[{"introduced":"0"},{"fixed":"396f447500407693d6ae1e64db59782862ca7506"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"6.9.11"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["6.9.9","6.9.8","6.9.4","6.9.7","6.9.6","6.9.5","6.9.3","6.9.2","6.9.1","6.9.0","6.8.1","6.8.2","6.7.11"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-62296.json","vanir_signatures_modified":"2026-08-09T08:05:11Z","vanir_signatures":[{"source":"https://github.com/hapifhir/org.hl7.fhir.core/commit/396f447500407693d6ae1e64db59782862ca7506","target":{"file":"org.hl7.fhir.utilities/src/main/java/org/hl7/fhir/utilities/xhtml/XhtmlParser.java","function":"parseElement"},"deprecated":false,"digest":{"length":746,"function_hash":"198859985819541875461976648171601804986"},"id":"CVE-2026-62296-050dc0e8","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-62296-33680024","signature_type":"Line","signature_version":"v1","source":"https://github.com/hapifhir/org.hl7.fhir.core/commit/396f447500407693d6ae1e64db59782862ca7506","target":{"file":"org.hl7.fhir.utilities/src/main/java/org/hl7/fhir/utilities/json/parser/JsonParser.java"},"deprecated":false,"digest":{"line_hashes":["79593679323901234110806024549928524211","12171244668519292412350463326027559432","78139065511233308537018699900946059830","271280053717451113443881252728527142181","91931524333809736195623035587954405005","83663460041646696610510156311985593340","89113023621798937282809023164912680964","298669730936968119777089306350241553607","285906449065287154892712533965108023130","265495101296212854304193888771767767146","170318552977827958800230660667614685728","141306378708815001905238720347290518418","232814005972718999626852576271585831333","241536062391576873690384311886961656565","257094436895162903951878926631728834214","337974831831435940241070616805758588933","261068351583908889740932730863809780068","328003151266302268216377876414578735823"],"threshold":0.9}},{"source":"https://github.com/hapifhir/org.hl7.fhir.core/commit/396f447500407693d6ae1e64db59782862ca7506","target":{"file":"org.hl7.fhir.utilities/src/test/java/org/hl7/fhir/utilities/json/JsonParserTests.java"},"deprecated":false,"digest":{"line_hashes":["13231589082410998616365685922709632616","102248407972432671800141586969788703657","58242369192115067926082408900804893606","301491735343400043967550868323273342014","320128256822643681250572534090232739272"],"threshold":0.9},"id":"CVE-2026-62296-3abfabc0","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2026-62296-44f621e2","signature_type":"Function","signature_version":"v1","source":"https://github.com/hapifhir/org.hl7.fhir.core/commit/396f447500407693d6ae1e64db59782862ca7506","target":{"file":"org.hl7.fhir.utilities/src/main/java/org/hl7/fhir/utilities/json/parser/JsonParser.java","function":"readArray"},"deprecated":false,"digest":{"function_hash":"218006484714243940955914628826294664168","length":2204}},{"id":"CVE-2026-62296-54fba999","signature_type":"Function","signature_version":"v1","source":"https://github.com/hapifhir/org.hl7.fhir.core/commit/396f447500407693d6ae1e64db59782862ca7506","target":{"file":"org.hl7.fhir.utilities/src/main/java/org/hl7/fhir/utilities/json/parser/JsonParser.java","function":"readObject"},"deprecated":false,"digest":{"length":3175,"function_hash":"35726950358675232549253352331995444362"}},{"deprecated":false,"digest":{"function_hash":"35520321064570470507359246374186728444","length":209},"id":"CVE-2026-62296-5fdd9581","signature_type":"Function","signature_version":"v1","source":"https://github.com/hapifhir/org.hl7.fhir.core/commit/396f447500407693d6ae1e64db59782862ca7506","target":{"file":"org.hl7.fhir.utilities/src/main/java/org/hl7/fhir/utilities/xml/XMLUtil.java","function":"newXXEProtectedDocumentBuilderFactory"}},{"target":{"file":"org.hl7.fhir.utilities/src/main/java/org/hl7/fhir/utilities/xhtml/XhtmlParser.java"},"deprecated":false,"digest":{"line_hashes":["28838802855149614147529584437251595464","323939453019960865653565834576942864065","155558383782060358453598376366851350726","147439837033672902310103865135590737285","316711770153868033335353226530124984327","93864826724956475425925031477096236281","223135053556515163113599545016504480535","8446616386685384797574260227889190690"],"threshold":0.9},"id":"CVE-2026-62296-a2cbdf1c","signature_type":"Line","signature_version":"v1","source":"https://github.com/hapifhir/org.hl7.fhir.core/commit/396f447500407693d6ae1e64db59782862ca7506"},{"deprecated":false,"digest":{"line_hashes":["193554984397679089185588386282754542205","91840663784319101336071758970143744829","145747032202750657058505903630913301883","223380909278401252187967292611749332365","300895393451319590435396964487424932229","41862026528797901383007716048960227019","181585491487816371759828734239473175886","1938237679005044047773568861712989717","322619268632842818158735659998005683713","229967698371065612558801519908704778877"],"threshold":0.9},"id":"CVE-2026-62296-a715828a","signature_type":"Line","signature_version":"v1","source":"https://github.com/hapifhir/org.hl7.fhir.core/commit/396f447500407693d6ae1e64db59782862ca7506","target":{"file":"org.hl7.fhir.utilities/src/main/java/org/hl7/fhir/utilities/xml/XMLUtil.java"}},{"deprecated":false,"digest":{"line_hashes":["8147395381292895751976343515503389015","34419926887613138659429650444376054918","180889054843296365292526630092911465173","250001890055181610984101712506911580893","209222007397681753887655297996991132327","180210433636926805637912275064666960626","241905620139451643786647800146803560606"],"threshold":0.9},"id":"CVE-2026-62296-e2ef3c35","signature_type":"Line","signature_version":"v1","source":"https://github.com/hapifhir/org.hl7.fhir.core/commit/396f447500407693d6ae1e64db59782862ca7506","target":{"file":"org.hl7.fhir.utilities/src/test/java/org/hl7/fhir/utilities/xml/XMLUtilTests.java"}}]}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}