CVE-2026-62296: hapifhir org.hl7.fhir.core, отказ на услуга

Описание

Оригинално описание

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, XhtmlParser.java imposes no maximum element nesting depth, so a deeply nested text.div narrative triggers unbounded recursion between parseElementInner() and parseElement(), raising a StackOverflowError. An attacker who can submit FHIR resources containing such narratives can thus crash a parsing or validation worker thread, affecting validator services and any application that parses attacker-supplied FHIR JSON or XML. This issue is fixed in version 6.9.11.

Засегнати продукти

• hapifhir org.hl7.fhir.core: < 6.9.11
• hapifhir ca.uhn.hapi.fhir:org.hl7.fhir.r5: < 6.9.11
• hapifhir ca.uhn.hapi.fhir:org.hl7.fhir.utilities: < 6.9.11
• hapifhir ca.uhn.hapi.fhir:org.hl7.fhir.validation: < 6.9.11
• hapifhir ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli: < 6.9.11

Вид слабост

• CWE-20 Неправилно валидиране на входните данни
• CWE-400 Неконтролирано потребление на ресурси
• CWE-674 Uncontrolled Recursion

История

Други уязвимости в hapifhir org.hl7.fhir.core

• 7.5CVE-2026-81876
• 7.5CVE-2026-81875
• 7.5CVE-2026-62295
• 5.0CVE-2026-62293
• 7.5CVE-2026-49485

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-62296
• https://nvd.nist.gov/vuln/detail/CVE-2026-62296
• https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-5v24-q6x8-hc38
• https://github.com/hapifhir/org.hl7.fhir.core/commit/396f447500407693d6ae1e64db59782862ca7506