Vulnerability · Published Sep 16, 2026 · Assigned by GitHub_M

CVE-2026-81875HAPI FHIR: SHCParser unbounded DEFLATE decompression causes denial of service

High 7.5

In plain English

A high-severity improper input validation in org.hl7.fhir.core from hapifhir. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.6%top 49.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.12, SHCParser in org.hl7.fhir.r5/src/main/java/org/hl7/fhir/r5/elementmodel/SHCParser.java can consume attacker-controlled Smart Health Card JWT content whose header contains zip: "DEF" and whose small raw-DEFLATE payload expands to a very large value. SHCParser.decodeJWT() passes the decoded payload to SHCParser.inflate(), which accumulates all decompressed bytes in a ByteArrayOutputStream without an output-size limit before JSON parsing, and SHCParser.decompress() contains the same unbounded pattern. An application or validator service that accepts attacker-supplied SHC content can therefore suffer excessive heap allocation, severe garbage-collection pressure, request failure, process instability, or process termination. This issue is fixed in version 6.9.12.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	ca.uhn.hapi.fhir:org.hl7.fhir.r5	6.9.12	GHSA-3w98-rrpr-fprr
Maven	ca.uhn.hapi.fhir:org.hl7.fhir.validation	6.9.12	GHSA-3w98-rrpr-fprr
Maven	ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli	no fix listed	GHSA-3w98-rrpr-fprr

Affected products (as reported)

Vendor	Product	Versions
hapifhir	org.hl7.fhir.core	< 6.9.12

Weakness: CWE-20, CWE-400, CWE-409 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-3w98-rrpr-fprr x_refsource_CONFIRM
https://github.com/hapifhir/org.hl7.fhir.core/pull/2493 x_refsource_MISC
https://github.com/hapifhir/org.hl7.fhir.core/commit/fbb94216e0ad21ded75be77e5e20242ba194e83f x_refsource_MISC
https://github.com/hapifhir/org.hl7.fhir.core/releases/tag/6.9.11 x_refsource_MISC
https://github.com/hapifhir/org.hl7.fhir.core/releases/tag/6.9.12 x_refsource_MISC