CVE-2026-62295

Name of the Vulnerable Software and Affected Versions HAPI FHIR versions prior to 6.9.11

Description The JSON utility parser in org.hl7.fhir.utilities.json.parser.JsonParser does not enforce a maximum nesting depth for arrays or objects. A syntactically valid but deeply nested FHIR JSON document can trigger unbounded recursion in the readArray() or readObject() functions. This leads to a StackOverflowError—a situation where the application's call stack exceeds its allocated limit—before structural validation occurs. An attacker submitting such resources can crash the request thread, potentially causing worker loss or process instability, resulting in a denial-of-service condition.

Recommendations Update to version 6.9.11.