A high-severity input validation vulnerability in HAPI FHIR allows remote attackers to trigger uncontrolled resource consumption, potentially causing a denial of service.

The application fails to properly validate input, leading to uncontrolled resource consumption and recursion (CWE-20, CWE-400, CWE-674). This allows an unauthenticated attacker to exhaust system resources by sending specially crafted requests.

The primary impact of this vulnerability is the potential for system downtime due to a denial of service. With a CVSS score of 7.5, this flaw poses a significant risk to healthcare interoperability platforms, which require high availability to support patient care and administrative operations.

Immediate Action: Upgrade all HAPI FHIR components, including core, r5, utilities, and validation modules, to version 6.9.11 or later.

Proactive Monitoring: Monitor system resource usage, specifically CPU and memory metrics, for unexpected spikes that may indicate an ongoing denial of service attempt.

Compensating Controls: Implement strict rate limiting and request size validation at the API gateway or WAF level to mitigate the impact of malicious payloads.

Public Exploit Available: No (exploit_available: false)

Administrators should update their HAPI FHIR implementations immediately to version 6.9.11 to prevent potential denial of service attacks. Ensuring the software is up to date is essential for maintaining the stability and reliability of healthcare data exchange services.