HAPI FHIR versions before 6.9.11 contain an improper input validation vulnerability in the JSON utility parser (org.hl7.fhir.utilities.json.parser.JsonParser). The parser does not limit the maximum nesting depth of JSON arrays or objects, allowing an attacker to submit a deeply nested, syntactically valid FHIR JSON document that triggers unbounded recursion in readArray() or readObject() methods. This results in a StackOverflowError before structural validation occurs, which can crash the request thread and cause denial-of-service conditions if the service does not safely isolate such errors. The issue is resolved in version 6.9.11.

An attacker able to submit JSON resources for validation can cause a denial-of-service by triggering a StackOverflowError through deeply nested JSON input. This can crash the processing thread and potentially destabilize or cause worker loss in affected services. There is no impact on confidentiality or integrity reported.

Upgrade to HAPI FHIR version 6.9.11 or later, where this vulnerability is fixed by enforcing maximum nesting depth in the JSON parser. No other mitigation or temporary fix is indicated. Patch status is confirmed by the vendor advisory stating the issue is fixed in 6.9.11.