CVE-2026-81876

HAPI FHIR before version 6.9.12 contains an infinite-loop flaw in SHCParser (org.hl7.fhir.r5), which decompresses Smart Health Card JWTs: when the JWT header specifies zip: "DEF" and the raw DEFLATE payload is empty or truncated, java.util.zip.Inflater can report zero bytes inflated while never reaching a finished or needsInput-consuming state that ends the loop, and the loop also omits a needsDictionary() termination check; the same zero-progress pattern exists in SHCParser.decompress(). The SHC parsing path is reachable from ResourceChecker.java during file-format detection and from validation of Smart Health Cards, so a single unauthenticated, malformed validation request can pin one JVM worker thread indefinitely. An attacker sending multiple concurrent malformed requests can exhaust all validation worker threads, causing a full denial of service on the FHIR server (CVSS availability impact high, no confidentiality or integrity impact). Any deployment of HAPI FHIR prior to 6.9.12 that exposes validation or content-detection endpoints handling attacker-supplied payloads is affected. No public proof-of-concept is known and the flaw is not listed in CISA KEV, so exploitation is not currently confirmed in the wild.

What to do: Upgrade HAPI FHIR to version 6.9.12 or later, which fixes the loop termination conditions in SHCParser. If upgrading is not immediately possible, restrict or rate-limit access to FHIR $validate and any endpoints that accept arbitrary content for format detection, and block or closely monitor requests containing Smart Health Card JWTs with DEFLATE-compressed payloads. Check exposed instances for signs of validation-worker thread exhaustion (hung worker threads, stalled validation requests).