CVE-2026-62295

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, the JSON utility parser in org.hl7.fhir.utilities.json.parser.JsonParser enforces no maximum nesting depth for arrays or objects. As a result, a small but deeply nested,...

PT-2026-69137

Name of the Vulnerable Software and Affected Versions HAPI FHIR versions prior to 6.9.11 Description The XhtmlParser.java component does not impose a maximum element nesting depth. This allows a deeply nested text.div narrative to trigger unbounded recursion between the parseElementInner and...