Description

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, XhtmlParser.java imposes no maximum element nesting depth, so a deeply nested text.div narrative triggers unbounded recursion between parseElementInner() and parseElement(), raising a StackOverflowError. An attacker who can submit FHIR resources containing such narratives can thus crash a parsing or validation worker thread, affecting validator services and any application that parses attacker-supplied FHIR JSON or XML. This issue is fixed in version 6.9.11.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-07T20:16:52.457Z",
  "pubdate": "2026-08-07T20:16:52.457Z",
  "executiveSummary": "HAPI FHIR prior to version 6.9.11 is susceptible to a denial of service vulnerability driven by uncontrolled recursion during the parsing of FHIR resources. Specifically, the vulnerability stems from the XhtmlParser.java component, which fails to enforce a maximum element nesting depth limitation when processing the text.div narrative within FHIR JSON or XML payloads.\nAn unauthenticated attacker capable of submitting maliciously crafted FHIR resources can exploit this flaw to trigger unbounded recursion between internal parsing functions, resulting in a fatal StackOverflowError. This exception terminates the executing worker thread, directly impacting validator services and any downstream healthcare interoperability application that ingests untrusted FHIR data.\nThe risk implications include service degradation, worker thread exhaustion, and potential application-level denial of service for dependent healthcare infrastructure. Successful exploitation requires the ability to transmit deeply nested narrative structures to parsing or validation endpoints, but does not necessitate elevated privileges or prior authentication.",
  "technicalDetails": "The vulnerability resides in the XhtmlParser.java component of HAPI FHIR, affecting all versions prior to 6.9.11. The root cause of the flaw is the complete absence of depth limitation controls or recursion guards when parsing the text.div narrative element within incoming FHIR payloads.\nDuring the parsing lifecycle, the vulnerable component executes mutual or direct recursive calls between parseElementInner() and parseElement() to traverse the hierarchical structure of the input document. When an attacker supplies a FHIR JSON or XML resource containing an excessively deep element nesting structure within the narrative div, the parser recursively descends through each nested child element without tracking the current depth or imposing a strict ceiling.\nThe attack flow proceeds as follows: First, the adversary crafts a specialized FHIR resource payload containing an artificially deep, recursive XML or JSON structure inside the text.div narrative field. Second, the attacker transmits this payload to a target application endpoint that utilizes HAPI FHIR for resource parsing, ingestion, or validation. Third, the parsing engine invokes XhtmlParser.java, initiating the recursive traversal via parseElement() and parseElementInner(). Fourth, as the recursion depth exceeds the physical limits of the underlying Java Virtual Machine (JVM) call stack, a fatal StackOverflowError is thrown. Finally, this unhandled or thread-terminating error crashes the active parsing or validation worker thread, rendering the service temporarily or permanently unavailable depending on process management and worker pool configurations.\nThe affected component is XhtmlParser.java within HAPI FHIR versions prior to 6.9.11. Exploitation requires network exposure to endpoints that accept and process untrusted FHIR JSON or XML inputs. No authentication or elevated privileges are required, provided the target service processes attacker-supplied payloads. The post-exploitation impact is strictly limited to availability loss via denial of service, as arbitrary code execution or unauthorized data access is not facilitated by this specific memory exhaustion vector."
}