CVE-2026-81876

Name of the Vulnerable Software and Affected Versions HAPI FHIR versions prior to 6.9.12

Description A denial-of-service issue exists when processing Smart Health Card (SHC) JWT content. If the JWT header contains zip: "DEF" and the raw-DEFLATE payload is empty or truncated, the SHCParser.inflate() and SHCParser.decompress() functions can enter an infinite loop. This occurs because the loop only checks if the inflater is finished and fails to account for zero-progress output, the need for more input, or the need for a dictionary. An attacker can exploit this by submitting a malformed validation request, which pins a JVM worker thread indefinitely. Concurrent requests of this nature can exhaust all available validation workers, leading to a complete service outage. The issue can be triggered during SHC validation or during file-format detection within ResourceChecker.java.

Recommendations Update HAPI FHIR to version 6.9.12.