CVE-2026-81875

Name of the Vulnerable Software and Affected Versions HAPI FHIR versions prior to 6.9.12

Description The SHCParser component in org.hl7.fhir.r5/src/main/java/org/hl7/fhir/r5/elementmodel/SHCParser.java fails to limit the size of decompressed Smart Health Card JWT payloads. When a JWT header contains zip: "DEF", the decodeJWT() function passes the payload to inflate() and decompress(), both of which accumulate decompressed bytes in a ByteArrayOutputStream without an output-size limit. An attacker can provide a small raw-DEFLATE payload that expands to a very large value, leading to excessive heap allocation, severe garbage-collection pressure, request failure, process instability, or process termination.

Recommendations Update to version 6.9.12. As a temporary workaround, restrict the acceptance of Smart Health Card JWT content containing the zip: "DEF" header in the SHCParser component.