{"id":"CVE-2026-113873","kind":"vulnerability","aliases":["CVE-2026-113873"],"related":[],"title":"SmileCDR HAPI FHIR: crafted compressed request can exhaust heap and crash","description":"SmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an unauthenticated attacker to send compressed payloads that exhaust server heap or crash certain services when decompressed.","summary":"HAPI FHIR (Smile CDR) inflates gzip request bodies (Content-Encoding: gzip, on by default) with no size or ratio cap, before authorization runs. An unauthenticated caller can send a small body that expands to a huge byte array and cause OutOfMemoryError. A 65 KB body expanded to 64 MiB (1,028:1). The researcher called the routine directly and did not measure an outage on a running server. Source inspection found the same code in v8.8.2, v8.10.1 and v8.12.1. Smile CDR 2026.05.R01 is based on HAPI 8.10.0 and was not tested.","severity":"high","cvss":8.7,"epss":0.00344,"exploited":false,"exploited_at":null,"products":[{"name":"HAPI FHIR","fixed":[],"affected":"all versions (tested 8.10.0; code present in 8.8.2, 8.10.1, 8.12.1)","ecosystem":"maven"}],"ecosystems":["maven"],"tags":["dos","fhir","hapi-fhir","healthcare","java","package","self-hosted","smilecdr"],"not_affected_if":["auth-required","gateway-blocks-gzip","gateway-caps-decompressed-size"],"how_to_check":"Check whether you run HAPI FHIR JPA server or Smile CDR (hapi-fhir-server in your dependency tree, e.g. mvn dependency:tree | grep hapi-fhir). Then check whether your FHIR endpoint accepts requests with Content-Encoding: gzip and whether a gateway, WAF or servlet filter in front rejects gzip bodies or caps the decompressed size. All versions are listed as affected.","fix":"No fixed version as of 2026-10-22 (CVE lists all versions, fix not stated). Mitigation: at the reverse proxy or gateway, reject requests with Content-Encoding: gzip or cap the decompressed size, limit request body size, and set JVM memory limits with restart-on-OOM. Watch the HAPI FHIR and Smile CDR release notes. The researcher says upstream schedules 9.0.0 for 2026-11-19, but that release is only confirmed for the separate CVE-2026-113876 fix.","status":"open","published_at":"2026-10-22T18:17:27+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","triaged_at":"2026-10-23T22:35:13+00:00","updated_at":"2026-10-24T07:15:51+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T22:35:13Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"SmileCDR HAPI FHIR: crafted compressed request can exhaust heap and crash","impact":"low","summary":"SmileCDR's HAPI FHIR library does not handle highly compressed request data safely. An unauthenticated attacker can send a compressed payload that exhausts server heap memory or crashes services when decompressed.","category":"package","who_cares":["smilecdr","hapi-fhir","java","healthcare"],"confidence":0.6,"needs_auth":"no","worst_case":"Denial of service: services crash or run out of heap memory","analyst_note":"Sources give only the NVD description; check the NVD entry and SmileCDR advisory for affected versions, fixed version and whether decompression limits are configurable.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["auth-required"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000458,"input_tokens":2884,"output_tokens":340,"severity_before":"high"},"analyst_status":"done","analyst_note":"Sources give only the NVD description; check the NVD entry and SmileCDR advisory for affected versions, fixed version and whether decompression limits are configurable.","search":"'-113873':14A,17A '-2026':13A,16A '028':83B '1':82B,84B '2026.05':114B '64':80B '65':75B '8.10.0':120B 'allow':135C 'array':70B 'attack':138C 'author':54B 'base':117B 'bodi':39B,63B,77B 'byte':69B 'call':87B 'caller':58B 'cap':52B 'caus':72B 'cdr':35B,113B 'certain':149C 'code':106B 'compress':5A,133C,141C 'content':41B 'content-encod':40B 'craft':4A 'crash':11A,148C 'cve':12A,15A 'data':134C 'decompress':152C 'default':46B 'direct':90B 'dos':20B 'encod':42B 'exhaust':8A,144C 'expand':65B,78B 'fhir':3A,19A,21B,24B,33B,127C 'found':103B 'gzip':37B,43B 'handl':131C 'hapi':2A,18A,23B,32B,119B,126C 'hapi-fhir':22B 'healthcar':25B 'heap':9A,146C 'high':132C 'host':30B 'huge':68B 'inflat':36B 'inspect':102B 'java':26B 'kb':76B 'measur':94B 'mib':81B 'outag':96B 'outofmemoryerror':73B 'packag':27B 'payload':142C 'proper':130C 'r01':115B 'ratio':51B 'request':6A,38B 'research':86B 'routin':89B 'run':55B,99B 'self':29B 'self-host':28B 'send':60B,140C 'server':100B,145C 'servic':150C 'size':49B 'small':62B 'smile':34B,112B 'smilecdr':1A,31B,125C 'sourc':101B 'test':124B 'unauthent':57B,137C 'v8.10.1':109B 'v8.12.1':111B 'v8.8.2':108B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T18:17:27+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"9119a7d8-5eab-497f-8521-727c672e3725","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113873","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113873","severity":null,"published_at":"2026-10-22T18:17:27+00:00","modified_at":"2026-10-23T19:17:43+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-113873:494","url":null,"severity":null,"published_at":"2026-10-23T23:40:50+00:00","modified_at":"2026-10-23T23:40:50+00:00","first_seen_at":"2026-10-23T23:40:50+00:00","fetched_at":"2026-10-23T23:40:50+00:00","note":"Read researcher's oss-security post (Agarwal) and CVE record; no vendor advisory page read, no fix released, PoC is JUnit tests on researcher blog (not fetched). No X search done."},{"source":"epss","external_id":"CVE-2026-113873","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113873","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[{"id":2107,"url":"https://www.openwall.com/lists/oss-security/2026/10/22/34","title":"oss-security: HAPI FHIR cross-tenant partition override (Abhinav Agarwal)","kind":"poc","source":"analyst","text":"Reporter's writeup. Affected setup: RequestHeaderPartitionInterceptor behind a gateway setting X-Request-Partition-IDs. Caller puts extension http://hapifhir.io/fhir/ns/StructureDefinition/request-partition-ids on Bundle.entry.request, overriding trusted header in BaseTransactionProcessor.setRequestPartitionHeaderIfEntryHasTheExtension(). HAPI ships no STORAGE_PARTITION_SELECTED entitlement hook; an integrator hook blocked the override. Reproduced on 8.10.0; code present in 8.8.2, 8.10.1, 8.12.1 and master; handler first shipped v8.2.0. Smile CDR 2026.05.R01 is based on 8.10.0 (not tested). No fix. PoC: 7 JUnit classes at https://abhinavagarwal07.github.io/posts/hapi-fhir-authorization-findings/?src=oss","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2108,"url":"https://www.govinfosecurity.com/4-flaws-found-in-widely-used-health-data-exchange-software-a-33192","title":"4 Flaws Found in Widely Used Health Data Exchange Software","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":2110,"url":"https://www.cve.org/CVERecord?id=CVE-2026-113873","title":"CVE Record CVE-2026-113873 (CISA CNA)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}