CVE-2026-62296

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-62296
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-62296.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-62296
Aliases
  • GHSA-5v24-q6x8-hc38
Published
2026-08-07T20:03:17.024Z
Modified
2026-08-09T08:05:11.698060Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
HAPI FHIR: XHTML narrative parser unbounded recursion causes StackOverflow denial of service
Details

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, XhtmlParser.java imposes no maximum element nesting depth, so a deeply nested text.div narrative triggers unbounded recursion between parseElementInner() and parseElement(), raising a StackOverflowError. An attacker who can submit FHIR resources containing such narratives can thus crash a parsing or validation worker thread, affecting validator services and any application that parses attacker-supplied FHIR JSON or XML. This issue is fixed in version 6.9.11.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-20",
        "CWE-400",
        "CWE-674"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/62xxx/CVE-2026-62296.json"
}
References

Affected packages

Git / github.com/hapifhir/org.hl7.fhir.core

Affected ranges

Type
GIT
Repo
https://github.com/hapifhir/org.hl7.fhir.core
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
396f447500407693d6ae1e64db59782862ca7506
Database specific 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "6.9.11"
        }
    ]
}

Affected versions

6.*
6.7.11
6.8.1
6.8.2
6.9.0
6.9.1
6.9.2
6.9.3
6.9.4
6.9.5
6.9.6
6.9.7
6.9.8
6.9.9

Database specific

vanir_signatures_modified 
"2026-08-09T08:05:11Z"
vanir_signatures 
[
    {
        "target": {
            "function": "parseElement",
            "file": "org.hl7.fhir.utilities/src/main/java/org/hl7/fhir/utilities/xhtml/XhtmlParser.java"
        },
        "digest": {
            "length": 746.0,
            "function_hash": "198859985819541875461976648171601804986"
        },
        "signature_version": "v1",
        "signature_type": "Function",
        "deprecated": false,
        "id": "CVE-2026-62296-050dc0e8",
        "source": "https://github.com/hapifhir/org.hl7.fhir.core/commit/396f447500407693d6ae1e64db59782862ca7506"
    },
    {
        "target": {
            "file": "org.hl7.fhir.utilities/src/main/java/org/hl7/fhir/utilities/json/parser/JsonParser.java"
        },
        "digest": {
            "line_hashes": [
                "79593679323901234110806024549928524211",
                "12171244668519292412350463326027559432",
                "78139065511233308537018699900946059830",
                "271280053717451113443881252728527142181",
                "91931524333809736195623035587954405005",
                "83663460041646696610510156311985593340",
                "89113023621798937282809023164912680964",
                "298669730936968119777089306350241553607",
                "285906449065287154892712533965108023130",
                "265495101296212854304193888771767767146",
                "170318552977827958800230660667614685728",
                "141306378708815001905238720347290518418",
                "232814005972718999626852576271585831333",
                "241536062391576873690384311886961656565",
                "257094436895162903951878926631728834214",
                "337974831831435940241070616805758588933",
                "261068351583908889740932730863809780068",
                "328003151266302268216377876414578735823"
            ],
            "threshold": 0.9
        },
        "signature_version": "v1",
        "signature_type": "Line",
        "deprecated": false,
        "id": "CVE-2026-62296-33680024",
        "source": "https://github.com/hapifhir/org.hl7.fhir.core/commit/396f447500407693d6ae1e64db59782862ca7506"
    },
    {
        "target": {
            "file": "org.hl7.fhir.utilities/src/test/java/org/hl7/fhir/utilities/json/JsonParserTests.java"
        },
        "digest": {
            "line_hashes": [
                "13231589082410998616365685922709632616",
                "102248407972432671800141586969788703657",
                "58242369192115067926082408900804893606",
                "301491735343400043967550868323273342014",
                "320128256822643681250572534090232739272"
            ],
            "threshold": 0.9
        },
        "signature_version": "v1",
        "signature_type": "Line",
        "deprecated": false,
        "id": "CVE-2026-62296-3abfabc0",
        "source": "https://github.com/hapifhir/org.hl7.fhir.core/commit/396f447500407693d6ae1e64db59782862ca7506"
    },
    {
        "target": {
            "function": "readArray",
            "file": "org.hl7.fhir.utilities/src/main/java/org/hl7/fhir/utilities/json/parser/JsonParser.java"
        },
        "digest": {
            "length": 2204.0,
            "function_hash": "218006484714243940955914628826294664168"
        },
        "signature_version": "v1",
        "signature_type": "Function",
        "deprecated": false,
        "id": "CVE-2026-62296-44f621e2",
        "source": "https://github.com/hapifhir/org.hl7.fhir.core/commit/396f447500407693d6ae1e64db59782862ca7506"
    },
    {
        "target": {
            "function": "readObject",
            "file": "org.hl7.fhir.utilities/src/main/java/org/hl7/fhir/utilities/json/parser/JsonParser.java"
        },
        "digest": {
            "length": 3175.0,
            "function_hash": "35726950358675232549253352331995444362"
        },
        "signature_version": "v1",
        "signature_type": "Function",
        "deprecated": false,
        "id": "CVE-2026-62296-54fba999",
        "source": "https://github.com/hapifhir/org.hl7.fhir.core/commit/396f447500407693d6ae1e64db59782862ca7506"
    },
    {
        "target": {
            "function": "newXXEProtectedDocumentBuilderFactory",
            "file": "org.hl7.fhir.utilities/src/main/java/org/hl7/fhir/utilities/xml/XMLUtil.java"
        },
        "digest": {
            "length": 209.0,
            "function_hash": "35520321064570470507359246374186728444"
        },
        "signature_version": "v1",
        "signature_type": "Function",
        "deprecated": false,
        "id": "CVE-2026-62296-5fdd9581",
        "source": "https://github.com/hapifhir/org.hl7.fhir.core/commit/396f447500407693d6ae1e64db59782862ca7506"
    },
    {
        "target": {
            "file": "org.hl7.fhir.utilities/src/main/java/org/hl7/fhir/utilities/xhtml/XhtmlParser.java"
        },
        "digest": {
            "line_hashes": [
                "28838802855149614147529584437251595464",
                "323939453019960865653565834576942864065",
                "155558383782060358453598376366851350726",
                "147439837033672902310103865135590737285",
                "316711770153868033335353226530124984327",
                "93864826724956475425925031477096236281",
                "223135053556515163113599545016504480535",
                "8446616386685384797574260227889190690"
            ],
            "threshold": 0.9
        },
        "signature_version": "v1",
        "signature_type": "Line",
        "deprecated": false,
        "id": "CVE-2026-62296-a2cbdf1c",
        "source": "https://github.com/hapifhir/org.hl7.fhir.core/commit/396f447500407693d6ae1e64db59782862ca7506"
    },
    {
        "target": {
            "file": "org.hl7.fhir.utilities/src/main/java/org/hl7/fhir/utilities/xml/XMLUtil.java"
        },
        "digest": {
            "line_hashes": [
                "193554984397679089185588386282754542205",
                "91840663784319101336071758970143744829",
                "145747032202750657058505903630913301883",
                "223380909278401252187967292611749332365",
                "300895393451319590435396964487424932229",
                "41862026528797901383007716048960227019",
                "181585491487816371759828734239473175886",
                "1938237679005044047773568861712989717",
                "322619268632842818158735659998005683713",
                "229967698371065612558801519908704778877"
            ],
            "threshold": 0.9
        },
        "signature_version": "v1",
        "signature_type": "Line",
        "deprecated": false,
        "id": "CVE-2026-62296-a715828a",
        "source": "https://github.com/hapifhir/org.hl7.fhir.core/commit/396f447500407693d6ae1e64db59782862ca7506"
    },
    {
        "target": {
            "file": "org.hl7.fhir.utilities/src/test/java/org/hl7/fhir/utilities/xml/XMLUtilTests.java"
        },
        "digest": {
            "line_hashes": [
                "8147395381292895751976343515503389015",
                "34419926887613138659429650444376054918",
                "180889054843296365292526630092911465173",
                "250001890055181610984101712506911580893",
                "209222007397681753887655297996991132327",
                "180210433636926805637912275064666960626",
                "241905620139451643786647800146803560606"
            ],
            "threshold": 0.9
        },
        "signature_version": "v1",
        "signature_type": "Line",
        "deprecated": false,
        "id": "CVE-2026-62296-e2ef3c35",
        "source": "https://github.com/hapifhir/org.hl7.fhir.core/commit/396f447500407693d6ae1e64db59782862ca7506"
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-62296.json"