CVE-2026-81875

HAPI FHIR's SHCParser, which handles SMART Health Card JWTs, fails to limit the size of DEFLATE-decompressed output before parsing it as JSON. An attacker can submit a health-card JWT whose header declares zip: "DEF" and whose tiny compressed payload inflates to a very large value, causing the parser to buffer the entire expanded result in memory. This triggers excessive heap allocation and heavy garbage-collection pressure, leading to failed requests, service instability, or full process termination — a denial of service only, with no confidentiality or integrity impact (CVSS 7.5, availability high). Any application or validator service that accepts attacker-supplied Smart Health Card content is affected, including deployments using the org.hl7.fhir.r5 SHC parsing path. No public proof-of-concept or in-the-wild exploitation is known, and the flaw is fixed in version 6.9.12.

What to do: Upgrade HAPI FHIR to version 6.9.12 or later. As interim mitigation, audit whether your services (FHIR servers, validator endpoints, patient-facing apps) accept attacker-supplied Smart Health Card JWTs; if so, cap JWT payload size, limit decompressed output size or reject zip: "DEF" tokens if not required, and apply rate limits on affected endpoints.