CVE-2026-81875 HAPI FHIR: SHCParser unbounded DEFLATE decompression causes denial of service
Attackers can cause denial of service in applications using HAPI FHIR by sending Smart Health Card JWTs with malicious DEFLATE payloads that exhaust memory.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-81875?
CVE-2026-81875 is a high-severity denial of service vulnerability in hapifhir org.hl7.fhir.core, published on 16 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.12, SHCParser in org.hl7.fhir.r5/src/main/java/org/hl7/fhir/r5/elementmodel/SHCParser.java can consume attacker-controlled Smart Health Card JWT content whose header contains zip: "DEF" and whose small raw-DEFLATE payload expands to a very large value. SHCParser.decodeJWT() passes the decoded payload to SHCParser.inflate(), which accumulates all decompressed bytes in a ByteArrayOutputStream without an output-size limit before JSON parsing, and SHCParser.decompress() contains the same unbounded pattern. An application or validator service that accepts attacker-supplied SHC content can therefore suffer excessive heap allocation, severe garbage-collection pressure, request failure, process instability, or process termination. This issue is fixed in version 6.9.12.
Which versions are affected by CVE-2026-81875?
6 open source packages ship an affected version, including ca.uhn.hapi.fhir:org.hl7.fhir.r5, ca.uhn.hapi.fhir:org.hl7.fhir.validation and ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli.
| Package | Affected | Fixed in |
|---|---|---|
ca.uhn.hapi.fhir:org.hl7.fhir.r5 Maven | All versions | 6.9.12 |
ca.uhn.hapi.fhir:org.hl7.fhir.r5 Maven | All versions | 6.9.12 |
ca.uhn.hapi.fhir:org.hl7.fhir.validation Maven | All versions | 6.9.12 |
ca.uhn.hapi.fhir:org.hl7.fhir.validation Maven | All versions | 6.9.12 |
ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli Maven | All versions to 5.0.0 | None |
ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli Maven | All versions to 5.0.0 | None |
How do I fix CVE-2026-81875?
Upgrade ca.uhn.hapi.fhir:org.hl7.fhir.r5 to 6.9.12 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-81875 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-81875 exists.
Sources
Also known as GHSA-3w98-rrpr-fprr, ROOT-APP-MAVEN-CVE-2026-81875.