CVE-2026-81875: HAPI FHIR: SHCParser unbounded DEFLATE decompression causes denial of service
SHCParser inflates compressed Smart Health Card JWT payloads into memory without a decompressed-size limit. An attacker who can submit SHC content for validation can craft a small compressed JWT payload that expands to a very large byte array, causing memory exhaustion or severe garbage collection pressure.
References
- github.com/advisories/GHSA-3w98-rrpr-fprr
- github.com/hapifhir/org.hl7.fhir.core/commit/fbb94216e0ad21ded75be77e5e20242ba194e83f
- github.com/hapifhir/org.hl7.fhir.core/pull/2493
- github.com/hapifhir/org.hl7.fhir.core/releases/tag/6.9.11
- github.com/hapifhir/org.hl7.fhir.core/releases/tag/6.9.12
- github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-3w98-rrpr-fprr
- nvd.nist.gov/vuln/detail/CVE-2026-81875
Code Behaviors & Features
Detect and mitigate CVE-2026-81875 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →