DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-81875: CVE-2026-81875: Unbounded DEFLATE Decompression Denial of Service in HAPI FHIR SHCParser

#security #cve #cybersecurity

CVE-2026-81875: Unbounded DEFLATE Decompression Denial of Service in HAPI FHIR SHCParser

Vulnerability ID: CVE-2026-81875
CVSS Score: 7.5
Published: 2026-09-17

A critical denial of service vulnerability exists in the HAPI FHIR SHCParser within the org.hl7.fhir.core Java library. Unbounded decompression of raw DEFLATE data during Smart Health Card parsing allows unauthenticated remote attackers to trigger JVM heap exhaustion and crash the application.

TL;DR

Unbounded DEFLATE decompression in HAPI FHIR SHCParser allows remote attackers to cause JVM OutOfMemory crashes via malformed Smart Health Card payloads.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-409 (Improper Handling of Highly Compressed Data)
  • Attack Vector: Network (AV:N)
  • CVSS v3.1: 7.5 (High)
  • EPSS Score: 0.0063 (Percentile: 48.59%)
  • Impact: Denial of Service (DoS) via JVM Heap Exhaustion
  • Exploit Status: Proof of Concept (PoC) Available
  • KEV Status: Not Listed

Affected Systems

  • Applications running Java with the HAPI FHIR core libraries (org.hl7.fhir.core) parsing Smart Health Cards (SHC).
  • Vaccination validation portals and clinical verification services that process health card JWTs.
  • org.hl7.fhir.core: < 6.9.12 (Fixed in: 6.9.12)

Code Analysis

Commit: fbb9421

Add size tracking and exception handling on decompressed output within SHCParser inflate function.

Mitigation Strategies

  • Upgrade HAPI FHIR dependencies to version 6.9.12 or later.
  • Implement request size filtering and JWT validation in API Gateways.
  • Configure Web Application Firewall rules to block JWT payloads using DEFLATE compression if not explicitly required.
  • Set explicit JVM constraints to restart the server automatically on OutOfMemoryError.

Remediation Steps:

  1. Identify all projects and microservices using HAPI FHIR core (org.hl7.fhir.core).
  2. Update the dependency version in pom.xml or build.gradle to 6.9.12.
  3. Rebuild the application and execute integration tests using the provided PoC structure to verify successful protection.
  4. Deploy the updated applications and configure container orchestrators to handle JVM crashes safely during transition periods.

References

Read the full report for CVE-2026-81875 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)