How do I check whether I am affected by CVE-2026-113873?

Check whether you run HAPI FHIR JPA server or Smile CDR (hapi-fhir-server in your dependency tree, e.g. mvn dependency:tree | grep hapi-fhir). Then check whether your FHIR endpoint accepts requests with Content-Encoding: gzip and whether a gateway, WAF or servlet filter in front rejects gzip bodies or caps the decompressed size. All versions are listed as affected.

What is the fix for CVE-2026-113873?

No fixed version as of 2026-10-22 (CVE lists all versions, fix not stated). Mitigation: at the reverse proxy or gateway, reject requests with Content-Encoding: gzip or cap the decompressed size, limit request body size, and set JVM memory limits with restart-on-OOM. Watch the HAPI FHIR and Smile CDR release notes. The researcher says upstream schedules 9.0.0 for 2026-11-19, but that release is only confirmed for the separate CVE-2026-113876 fix.

Who is not affected by CVE-2026-113873?

Not affected if: auth-required, gateway-blocks-gzip, gateway-caps-decompressed-size.

Live › vulnerability › CVE-2026-113873

Go to dashboard

high8.7Packagemaven

SmileCDR HAPI FHIR: crafted compressed request can exhaust heap and crash

HAPI FHIR (Smile CDR) inflates gzip request bodies (Content-Encoding: gzip, on by default) with no size or ratio cap, before authorization runs. An unauthenticated caller can send a small body that expands to a huge byte array and cause OutOfMemoryError. A 65 KB body expanded to 64 MiB (1,028:1). The researcher called the routine directly and did not measure an outage on a running server. Source inspection found the same code in v8.8.2, v8.10.1 and v8.12.1. Smile CDR 2026.05.R01 is based on HAPI 8.10.0 and was not tested.

Summary written from the sources below. Check the originals before acting.

CVSS 4.0

8.7

high

scored by 9119a7d8-5eab-497f-8521-727c672e3725

known so far6 of 6

First public: Oct 22, 2026 UTC
Last modified: Oct 23, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: 0.3% in 30d

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: No.
Needs a special setup: Not known from the sources.
Reachable from: internet.
Worst case: Denial of service: services crash or run out of heap memory.
CVSS said: 8.7. The facts above say medium; we keep the sources' high until an analyst looks.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-113873

Go to dashboard

high8.7Packagemaven

SmileCDR HAPI FHIR: crafted compressed request can exhaust heap and crash

Summary written from the sources below. Check the originals before acting.

CVSS 4.0

8.7

high

scored by 9119a7d8-5eab-497f-8521-727c672e3725

known so far6 of 6

First public: Oct 22, 2026 UTC
Last modified: Oct 23, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: 0.3% in 30d

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: No.
Needs a special setup: Not known from the sources.
Reachable from: internet.
Worst case: Denial of service: services crash or run out of heap memory.
CVSS said: 8.7. The facts above say medium; we keep the sources' high until an analyst looks.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

SmileCDR HAPI FHIR: crafted compressed request can exhaust heap and crash

Why it is high, and not just CVSS

Who is affected

Know the next one before it finds you.

SmileCDR HAPI FHIR: crafted compressed request can exhaust heap and crash

Why it is high, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources