A high-severity vulnerability in HAPI FHIR related to improper input validation allows unauthenticated attackers to exhaust resources and cause a denial of service.

This vulnerability involves improper input validation leading to uncontrolled resource consumption and uncontrolled recursion (CWE-20, CWE-400, CWE-674). An unauthenticated attacker can exploit this by submitting malicious input that forces the application into a resource-heavy recursive loop.

Exploitation of this vulnerability results in an effective denial of service, rendering the HAPI FHIR service unresponsive. Given the CVSS score of 7.5, this presents a severe risk to organizations relying on this library for critical health data interoperability, as downtime could disrupt essential information flows.

Immediate Action: Update all HAPI FHIR libraries, including core and validation modules, to version 6.9.11 to resolve the underlying input validation flaws.

Proactive Monitoring: Implement monitoring for high memory or CPU usage patterns that correlate with incoming API requests to identify potential exploitation attempts.

Compensating Controls: Deploy a Web Application Firewall or an API gateway configured to inspect and block malformed or excessively deep recursive FHIR requests.

Public Exploit Available: No (exploit_available: false)

Immediate remediation via patching to version 6.9.11 is strongly advised. Organizations should treat this as a high-priority update to ensure the continued availability of services and to protect against potential denial of service attacks.