CVE-2026-62296

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, XhtmlParser.java imposes no maximum element nesting depth, so a deeply nested text.div narrative triggers unbounded recursion between parseElementInner() and parseElement(), raising a StackOverflowError. An attacker who can submit FHIR resources containing such narratives can thus crash a parsing or validation worker thread, affecting validator services and any application that parses attacker-supplied FHIR JSON or XML. This issue is fixed in version 6.9.11.

• CWE-20
• CWE-400
• CWE-674

• https://github.com/hapifhir/org.hl7.fhir.core/commit/396f447500407693d6ae1e64db59782862ca7506
• https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-5v24-q6x8-hc38
• https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-5v24-q6x8-hc38

Published

Aug 7, 2026

Last Modified

Aug 10, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-62287Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-6229The Royal Elementor Addons plugin for WordPress is vulnerabl…7.2
• CVE-2026-62290cert-manager adds certificates and certificate issuers as re…7.3
• CVE-2026-62293HAPI FHIR is a complete implementation of the HL7 FHIR stand…5
• CVE-2026-62294Flameshot is powerful yet simple to use screenshot software.…5.1
• CVE-2026-62295HAPI FHIR is a complete implementation of the HL7 FHIR stand…7.5
• CVE-2026-62299CoreDNS is a DNS server written in Go. Prior to 1.14.5, the …5.3
• CVE-2026-6230The Tainacan plugin for WordPress is vulnerable to time-base…7.5
• CVE-2026-62309CoreDNS is a DNS server written in Go. Prior to 1.14.4, a si…7.5
• CVE-2026-6231The bson_validate function may return early on specific inpu…7.5
• CVE-2026-623129Router is an AI router & token saver. Prior to 0.5.2, 9Rout…8.8
• CVE-2026-62314Anubis is a Web AI Firewall Utility that challenges users' c…5.8