Answer in brief
CVE-2026-62296 records a Unknown severity vulnerability in HAPI FHIR: XHTML narrative parser unbounded recursion causes StackOverflow denial of service. The current sources do not mark it as known exploited. The current feed maps hapifhir/ca.uhn.hapi.fhir:org.hl7.fhir.r5 (generic), hapifhir/ca.uhn.hapi.fhir:org.hl7.fhir.utilities (generic), hapifhir/ca.uhn.hapi.fhir:org.hl7.fhir.validation (generic), hapifhir/ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps hapifhir/ca.uhn.hapi.fhir:org.hl7.fhir.r5 (generic), hapifhir/ca.uhn.hapi.fhir:org.hl7.fhir.utilities (generic), hapifhir/ca.uhn.hapi.fhir:org.hl7.fhir.validation (generic), hapifhir/ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| hapifhir/ca.uhn.hapi.fhir:org.hl7.fhir.r5generic | < 6.9.11 | Not reported |
| hapifhir/ca.uhn.hapi.fhir:org.hl7.fhir.utilitiesgeneric | < 6.9.11 | Not reported |
| hapifhir/ca.uhn.hapi.fhir:org.hl7.fhir.validationgeneric | < 6.9.11 | Not reported |
| hapifhir/ca.uhn.hapi.fhir:org.hl7.fhir.validation.cligeneric | < 6.9.11 | Not reported |
| hapifhir/org.hl7.fhir.coregeneric | < 6.9.11 | Not reported |
Published upstream
Aug 7, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 7, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 7, 2026
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, XhtmlParser.java imposes no maximum element nesting depth, so a deeply nested text.div narrative triggers unbounded recursion between parseElementInner() and parseElement(), raising a StackOverflowError. An attacker who can submit FHIR resources containing such narratives can thus crash a parsing or validation worker thread, affecting validator services and any application that parses attacker-supplied FHIR JSON or XML. This issue is fixed in version 6.9.11.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-62296 records a Unknown severity vulnerability in HAPI FHIR: XHTML narrative parser unbounded recursion causes StackOverflow denial of service. The current sources do not mark it as known exploited. The current feed maps hapifhir/ca.uhn.hapi.fhir:org.hl7.fhir.r5 (generic), hapifhir/ca.uhn.hapi.fhir:org.hl7.fhir.utilities (generic), hapifhir/ca.uhn.hapi.fhir:org.hl7.fhir.validation (generic), hapifhir/ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps hapifhir/ca.uhn.hapi.fhir:org.hl7.fhir.r5 (generic), hapifhir/ca.uhn.hapi.fhir:org.hl7.fhir.utilities (generic), hapifhir/ca.uhn.hapi.fhir:org.hl7.fhir.validation (generic), hapifhir/ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| hapifhir/ca.uhn.hapi.fhir:org.hl7.fhir.r5generic | < 6.9.11 | Not reported |
| hapifhir/ca.uhn.hapi.fhir:org.hl7.fhir.utilitiesgeneric | < 6.9.11 | Not reported |
| hapifhir/ca.uhn.hapi.fhir:org.hl7.fhir.validationgeneric | < 6.9.11 | Not reported |
| hapifhir/ca.uhn.hapi.fhir:org.hl7.fhir.validation.cligeneric | < 6.9.11 | Not reported |
| hapifhir/org.hl7.fhir.coregeneric | < 6.9.11 | Not reported |
Published upstream
Aug 7, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 7, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 7, 2026
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, XhtmlParser.java imposes no maximum element nesting depth, so a deeply nested text.div narrative triggers unbounded recursion between parseElementInner() and parseElement(), raising a StackOverflowError. An attacker who can submit FHIR resources containing such narratives can thus crash a parsing or validation worker thread, affecting validator services and any application that parses attacker-supplied FHIR JSON or XML. This issue is fixed in version 6.9.11.
Quoted source text, attributed separately from HOL analysis.