DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-81876: CVE-2026-81876: Unauthenticated Denial of Service via Infinite Loop in HAPI FHIR SHCParser

#security #cve #cybersecurity

CVE-2026-81876: Unauthenticated Denial of Service via Infinite Loop in HAPI FHIR SHCParser

Vulnerability ID: CVE-2026-81876
CVSS Score: 7.5
Published: 2026-09-17

CVE-2026-81876 is a high-severity Denial of Service vulnerability in HAPI FHIR, a complete Java implementation of the HL7 FHIR standard. The vulnerability stems from improper usage of Java's java.util.zip.Inflater class within the Smart Health Card (SHC) parser.

TL;DR

An unauthenticated remote attacker can trigger an infinite loop in the JVM by submitting a malformed JSON Web Token representing a Smart Health Card. This loop pins the worker thread at 100% CPU, leading to potential complete application Denial of Service.

Technical Details

  • CWE ID: CWE-835 / CWE-400
  • Attack Vector: Network (AV:N)
  • CVSS v3.1 Score: 7.5 (High)
  • EPSS Score: 0.0063
  • Impact: Denial of Service (DoS)
  • Exploit Status: Theoretical / Unproven
  • KEV Status: Not Listed

Affected Systems

  • HAPI FHIR core library (org.hl7.fhir.core)
  • org.hl7.fhir.core: < 6.9.12 (Fixed in: 6.9.12)

Code Analysis

Commit: d804558

Defensive checks inside SHCParser.inflate() and unit test

Commit: edd5d8c

Duplicate vulnerable pattern within private decompress helper

Mitigation Strategies

  • Upgrade HAPI FHIR core to version 6.9.12 or newer.
  • Configure Web Application Firewall (WAF) rules to detect and drop payloads containing DEFLATE headers in JWS structures.
  • Restrict input stream size to mitigate decompression bomb risks.

Remediation Steps:

  1. Identify dependencies on 'org.hl7.fhir.core' and related 'org.hl7.fhir.r5' modules within build configurations.
  2. Update the dependency version to 6.9.12.
  3. Rebuild and execute automated tests to verify standard FHIR processing functionality remains intact.
  4. Deploy the updated application artifact to staging and production environments.

References

Read the full report for CVE-2026-81876 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)