Skip to content
NewA calmer, faster ZeroHour
Vulnerability

CVE-2026-113873

Unauthenticated heap exhaustion in SmileCDR HAPI FHIR

CVSS 4.0
8.7 high
EPSS
—
Published
·
Modified
Analyze CVE-2026-113873 with Vani AIImpact, affected versions, exploitation status, mitigations and detection
AI analysisSummaries by Vani AI

SmileCDR HAPI FHIR does not properly handle highly compressed data. An unauthenticated attacker on the network can send compressed payloads that, when decompressed, exhaust server heap or crash certain services. There is no confidentiality or integrity impact. Affected versions and a fixed release have not been stated.

What to do: Apply SmileCDR's update for CVE-2026-113873. No fixed version or workaround is stated.

ProductAffected
SmileCDR HAPI FHIR—
Estimated exposure
No basis for an estimate.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description · NVD

SmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an unauthenticated attacker to send compressed payloads that exhaust server heap or crash certain services when decompressed.

Weakness
CWE-409
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD CVE.org GitHub PoCs EPSS (—)

In the news

1 story