CVE-2026-62295

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-62295
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-62295.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-62295
Aliases
  • GHSA-2cq7-hg49-56gc
Published
2026-08-07T19:36:31.274Z
Modified
2026-08-09T08:32:44.646583Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
HAPI FHIR: JSON utility parser unbounded recursion causes StackOverflow denial of service
Details

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, the JSON utility parser in org.hl7.fhir.utilities.json.parser.JsonParser enforces no maximum nesting depth for arrays or objects. As a result, a small but deeply nested, syntactically valid FHIR JSON document can trigger unbounded readArray() or readObject() recursion, raising a StackOverflowError before structural validation runs. An attacker who can submit JSON resources for validation can thus crash the request thread, and services that do not isolate StackOverflowError safely may experience worker loss or process instability — a denial-of-service condition. This issue is fixed in version 6.9.11.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/62xxx/CVE-2026-62295.json",
    "cwe_ids": [
        "CWE-20",
        "CWE-400",
        "CWE-674"
    ]
}
References

Affected packages

Git / github.com/hapifhir/org.hl7.fhir.core

Affected ranges

Type
GIT
Repo
https://github.com/hapifhir/org.hl7.fhir.core
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
396f447500407693d6ae1e64db59782862ca7506
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "6.9.11"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

6.*
6.7.11
6.8.1
6.8.2
6.9.0
6.9.1
6.9.2
6.9.3
6.9.4
6.9.5
6.9.6
6.9.7
6.9.8
6.9.9

Database specific

vanir_signatures_modified 
"2026-08-09T08:32:44Z"
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-62295.json"
vanir_signatures 
[
    {
        "signature_type": "Function",
        "target": {
            "file": "org.hl7.fhir.utilities/src/main/java/org/hl7/fhir/utilities/xhtml/XhtmlParser.java",
            "function": "parseElement"
        },
        "deprecated": false,
        "digest": {
            "length": 746.0,
            "function_hash": "198859985819541875461976648171601804986"
        },
        "signature_version": "v1",
        "source": "https://github.com/hapifhir/org.hl7.fhir.core/commit/396f447500407693d6ae1e64db59782862ca7506",
        "id": "CVE-2026-62295-050dc0e8"
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "org.hl7.fhir.utilities/src/main/java/org/hl7/fhir/utilities/json/parser/JsonParser.java"
        },
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "79593679323901234110806024549928524211",
                "12171244668519292412350463326027559432",
                "78139065511233308537018699900946059830",
                "271280053717451113443881252728527142181",
                "91931524333809736195623035587954405005",
                "83663460041646696610510156311985593340",
                "89113023621798937282809023164912680964",
                "298669730936968119777089306350241553607",
                "285906449065287154892712533965108023130",
                "265495101296212854304193888771767767146",
                "170318552977827958800230660667614685728",
                "141306378708815001905238720347290518418",
                "232814005972718999626852576271585831333",
                "241536062391576873690384311886961656565",
                "257094436895162903951878926631728834214",
                "337974831831435940241070616805758588933",
                "261068351583908889740932730863809780068",
                "328003151266302268216377876414578735823"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/hapifhir/org.hl7.fhir.core/commit/396f447500407693d6ae1e64db59782862ca7506",
        "id": "CVE-2026-62295-33680024"
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "org.hl7.fhir.utilities/src/test/java/org/hl7/fhir/utilities/json/JsonParserTests.java"
        },
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "13231589082410998616365685922709632616",
                "102248407972432671800141586969788703657",
                "58242369192115067926082408900804893606",
                "301491735343400043967550868323273342014",
                "320128256822643681250572534090232739272"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/hapifhir/org.hl7.fhir.core/commit/396f447500407693d6ae1e64db59782862ca7506",
        "id": "CVE-2026-62295-3abfabc0"
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "org.hl7.fhir.utilities/src/main/java/org/hl7/fhir/utilities/json/parser/JsonParser.java",
            "function": "readArray"
        },
        "deprecated": false,
        "digest": {
            "length": 2204.0,
            "function_hash": "218006484714243940955914628826294664168"
        },
        "signature_version": "v1",
        "source": "https://github.com/hapifhir/org.hl7.fhir.core/commit/396f447500407693d6ae1e64db59782862ca7506",
        "id": "CVE-2026-62295-44f621e2"
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "org.hl7.fhir.utilities/src/main/java/org/hl7/fhir/utilities/json/parser/JsonParser.java",
            "function": "readObject"
        },
        "deprecated": false,
        "digest": {
            "length": 3175.0,
            "function_hash": "35726950358675232549253352331995444362"
        },
        "signature_version": "v1",
        "source": "https://github.com/hapifhir/org.hl7.fhir.core/commit/396f447500407693d6ae1e64db59782862ca7506",
        "id": "CVE-2026-62295-54fba999"
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "org.hl7.fhir.utilities/src/main/java/org/hl7/fhir/utilities/xml/XMLUtil.java",
            "function": "newXXEProtectedDocumentBuilderFactory"
        },
        "deprecated": false,
        "digest": {
            "length": 209.0,
            "function_hash": "35520321064570470507359246374186728444"
        },
        "signature_version": "v1",
        "source": "https://github.com/hapifhir/org.hl7.fhir.core/commit/396f447500407693d6ae1e64db59782862ca7506",
        "id": "CVE-2026-62295-5fdd9581"
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "org.hl7.fhir.utilities/src/main/java/org/hl7/fhir/utilities/xhtml/XhtmlParser.java"
        },
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "28838802855149614147529584437251595464",
                "323939453019960865653565834576942864065",
                "155558383782060358453598376366851350726",
                "147439837033672902310103865135590737285",
                "316711770153868033335353226530124984327",
                "93864826724956475425925031477096236281",
                "223135053556515163113599545016504480535",
                "8446616386685384797574260227889190690"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/hapifhir/org.hl7.fhir.core/commit/396f447500407693d6ae1e64db59782862ca7506",
        "id": "CVE-2026-62295-a2cbdf1c"
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "org.hl7.fhir.utilities/src/main/java/org/hl7/fhir/utilities/xml/XMLUtil.java"
        },
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "193554984397679089185588386282754542205",
                "91840663784319101336071758970143744829",
                "145747032202750657058505903630913301883",
                "223380909278401252187967292611749332365",
                "300895393451319590435396964487424932229",
                "41862026528797901383007716048960227019",
                "181585491487816371759828734239473175886",
                "1938237679005044047773568861712989717",
                "322619268632842818158735659998005683713",
                "229967698371065612558801519908704778877"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/hapifhir/org.hl7.fhir.core/commit/396f447500407693d6ae1e64db59782862ca7506",
        "id": "CVE-2026-62295-a715828a"
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "org.hl7.fhir.utilities/src/test/java/org/hl7/fhir/utilities/xml/XMLUtilTests.java"
        },
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "8147395381292895751976343515503389015",
                "34419926887613138659429650444376054918",
                "180889054843296365292526630092911465173",
                "250001890055181610984101712506911580893",
                "209222007397681753887655297996991132327",
                "180210433636926805637912275064666960626",
                "241905620139451643786647800146803560606"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/hapifhir/org.hl7.fhir.core/commit/396f447500407693d6ae1e64db59782862ca7506",
        "id": "CVE-2026-62295-e2ef3c35"
    }
]