CVE-2026-62296

Name of the Vulnerable Software and Affected Versions HAPI FHIR versions prior to 6.9.11

Description The XhtmlParser.java component does not impose a maximum element nesting depth. This allows a deeply nested text.div narrative to trigger unbounded recursion between the parseElementInner() and parseElement() functions, resulting in a StackOverflowError. An attacker can exploit this by submitting FHIR resources with such narratives to crash parsing or validation worker threads, impacting validator services and applications that process attacker-supplied FHIR JSON or XML.

Recommendations Update to version 6.9.11.