CVE-2026-81875: HAPI FHIR: SHCParser unbounded DEFLATE decompression causes denial of service
SHCParser inflates compressed Smart Health Card JWT payloads into memory without a decompressed-size limit. An attacker who can submit SHC content for validation can craft a small compressed JWT payload that expands to a very large byte array, causing memory exhaustion or severe garbage collection pressure.
References
- github.com/advisories/GHSA-3w98-rrpr-fprr
- github.com/hapifhir/org.hl7.fhir.core/commit/fbb94216e0ad21ded75be77e5e20242ba194e83f
- github.com/hapifhir/org.hl7.fhir.core/pull/2493
- github.com/hapifhir/org.hl7.fhir.core/releases/tag/6.9.11
- github.com/hapifhir/org.hl7.fhir.core/releases/tag/6.9.12
- github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-3w98-rrpr-fprr
- nvd.nist.gov/vuln/detail/CVE-2026-81875
Code Behaviors & Features
Detect and mitigate CVE-2026-81875 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →