Description

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, the JSON utility parser in org.hl7.fhir.utilities.json.parser.JsonParser enforces no maximum nesting depth for arrays or objects. As a result, a small but deeply nested, syntactically valid FHIR JSON document can trigger unbounded readArray() or readObject() recursion, raising a StackOverflowError before structural validation runs. An attacker who can submit JSON resources for validation can thus crash the request thread, and services that do not isolate StackOverflowError safely may experience worker loss or process instability — a denial-of-service condition. This issue is fixed in version 6.9.11.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-07T20:16:52.310Z",
  "pubdate": "2026-08-07T20:16:52.310Z",
  "executiveSummary": "This vulnerability involves an uncontrolled recursion flaw categorized as a Denial of Service (DoS) vulnerability affecting the JSON utility parser within HAPI FHIR.\nThe flaw stems from the complete absence of a maximum nesting depth limitation for arrays and objects in the parser implementation.\nAn unauthenticated attacker capable of submitting specially crafted, syntactically valid JSON resources for validation can trigger unbounded recursion via the readArray() and readObject() functions.\nThis excessive recursion culminates in a catastrophic StackOverflowError that terminates the handling request thread.\nDepending on the architecture and error isolation capabilities of the hosting service, this condition can lead to worker thread exhaustion, process instability, or complete service degradation.\nThe risk implication is critical for availability, as malicious payloads can be small in size yet highly disruptive.\nExploitation requires only the ability to submit JSON resources to endpoints responsible for resource validation prior to version 6.9.11.",
  "technicalDetails": "The vulnerability resides in the JSON utility parser component located at org.hl7.fhir.utilities.json.parser.JsonParser within HAPI FHIR versions prior to 6.9.11.\nThe root cause of the vulnerability is the lack of recursion depth bounds checking when parsing nested JSON constructs such as arrays and objects.\nWhen the parser processes a JSON document, it recursively invokes methods like readArray() or readObject() to traverse hierarchical structures without maintaining a tracking counter or imposing a maximum nesting threshold.\nThe attack flow proceeds as follows: an attacker crafts a syntactically valid JSON document containing a deeply nested structure of objects or arrays.\nThe attacker submits this malicious payload to an API endpoint or service function that utilizes the vulnerable JsonParser for resource validation.\nUpon ingestion, the parser begins recursive descent parsing, consuming stack frames for each nested level.\nBecause structural validation executes after the parsing phase, the deeply nested payload bypasses preliminary validation checks and immediately exhausts the available Java Virtual Machine (JVM) thread stack space.\nThis triggers an unhandled StackOverflowError, abruptly terminating the execution thread.\nIn services lacking robust isolation for severe runtime errors, this thread termination can cascade, resulting in worker thread pool exhaustion, degradation of the application server, or full service crashes leading to a denial-of-service condition.\nNo specific authentication or high-level privileges are required beyond the baseline capability to submit JSON payloads to the validation pipeline."
}