CVE-2026-81876: HAPI FHIR: SHCParser DEFLATE infinite loop causes denial of service
A malformed Smart Health Card (SHC) JWT with zip: "DEF" and an empty or truncated DEFLATE payload causes SHCParser.inflate() to loop forever. This allows an attacker who can submit SHC content for validation to pin a JVM worker thread indefinitely, causing denial of service.
References
- github.com/advisories/GHSA-gq9c-wmrm-5hvr
- github.com/hapifhir/org.hl7.fhir.core/commit/d804558bd77372b1629e55a5b901cad3f5134cdc
- github.com/hapifhir/org.hl7.fhir.core/commit/edd5d8c139e669e39270785f08be7b63aefef24c
- github.com/hapifhir/org.hl7.fhir.core/pull/2493
- github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-gq9c-wmrm-5hvr
- nvd.nist.gov/vuln/detail/CVE-2026-81876
Code Behaviors & Features
Detect and mitigate CVE-2026-81876 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →