---
id: "CVE-2026-113873"
kind: "vulnerability"
aliases: ["CVE-2026-113873"]
title: "SmileCDR HAPI FHIR: crafted compressed request can exhaust heap and crash"
severity: "high"
cvss: 8.7
epss: 0.00397
exploited: false
status: "open"
category: "package"
products: [{"name": "HAPI FHIR", "fixed": [], "affected": "all versions (tested 8.10.0; code present in 8.8.2, 8.10.1, 8.12.1)", "ecosystem": "maven"}]
ecosystems: ["maven"]
tags: ["dos", "fhir", "hapi-fhir", "healthcare", "java", "package", "self-hosted", "smilecdr"]
not_affected_if: ["auth-required", "gateway-blocks-gzip", "gateway-caps-decompressed-size"]
published_at: "2026-10-22T18:17:27+00:00"
first_seen_at: "2026-10-23T21:57:31+00:00"
updated_at: "2026-10-25T12:38:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113873", "first_seen_at": "2026-10-23T21:57:31+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:40:50+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-113873", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# SmileCDR HAPI FHIR: crafted compressed request can exhaust heap and crash

HAPI FHIR (Smile CDR) inflates gzip request bodies (Content-Encoding: gzip, on by default) with no size or ratio cap, before authorization runs. An unauthenticated caller can send a small body that expands to a huge byte array and cause OutOfMemoryError. A 65 KB body expanded to 64 MiB (1,028:1). The researcher called the routine directly and did not measure an outage on a running server. Source inspection found the same code in v8.8.2, v8.10.1 and v8.12.1. Smile CDR 2026.05.R01 is based on HAPI 8.10.0 and was not tested.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- maven:HAPI FHIR affected all versions (tested 8.10.0; code present in 8.8.2, 8.10.1, 8.12.1) fixed ?

## How to check

Check whether you run HAPI FHIR JPA server or Smile CDR (hapi-fhir-server in your dependency tree, e.g. mvn dependency:tree | grep hapi-fhir). Then check whether your FHIR endpoint accepts requests with Content-Encoding: gzip and whether a gateway, WAF or servlet filter in front rejects gzip bodies or caps the decompressed size. All versions are listed as affected.

## Fix

No fixed version as of 2026-10-22 (CVE lists all versions, fix not stated). Mitigation: at the reverse proxy or gateway, reject requests with Content-Encoding: gzip or cap the decompressed size, limit request body size, and set JVM memory limits with restart-on-OOM. Watch the HAPI FHIR and Smile CDR release notes. The researcher says upstream schedules 9.0.0 for 2026-11-19, but that release is only confirmed for the separate CVE-2026-113876 fix.

## Timeline

- 2026-10-23T21:57:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113873
- 2026-10-23T23:40:50+00:00 analyst — Read researcher's oss-security post (Agarwal) and CVE record; no vendor advisory page read, no fix released, PoC is JUnit tests on researcher blog (not fetched). No X search done.
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-113873

## Documents

- [advisory] oss-security: HAPI FHIR cross-tenant partition override (Abhinav Agarwal) https://www.openwall.com/lists/oss-security/2026/10/22/34
- [advisory] CVE Record CVE-2026-113873 (CISA CNA) https://www.cve.org/CVERecord?id=CVE-2026-113873
- [mentions] 4 Flaws Found in Widely Used Health Data Exchange Software https://www.govinfosecurity.com/4-flaws-found-in-widely-used-health-data-exchange-software-a-33192

## From the sources

SmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an unauthenticated attacker to send compressed payloads that exhaust server heap or crash certain services when decompressed.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_