Executive brief
HAPI FHIR is a widely-used Java library for parsing and validating health data in FHIR format. The SHCParser component, which processes Smart Health Card JWT tokens, lacks limits on decompressed data size. An attacker can submit a small compressed payload that expands to hundreds of megabytes in memory, exhausting heap resources and crashing the application or causing severe performance degradation.
Technical details
The vulnerability is a classic unbounded decompression attack in the SHCParser.inflate() and decompress() methods. When processing JWT payloads marked with the DEFLATE compression header ("zip":"DEF"), the code decompresses data into a ByteArrayOutputStream without enforcing a maximum output size. Although MAX_ALLOWED_SHC_LENGTH checks the compressed JWT length, this check only logs an error and allows parsing to continue; there is no decompressed-size limit. An attacker can craft a highly compressible JSON payload (achieving 950x+ expansion ratios) and submit it as an SHC JWT. Network-reachable validators or applications accepting attacker-supplied SHC content are vulnerable; no authentication is required. Successful exploitation causes memory exhaustion, OutOfMemoryError, or severe garbage collection pressure, resulting in denial of service.
Affected products
- HAPI FHIR r5 (org.hl7.fhir.r5)
Timeline
- 2026-09-17: disclosed
- other: CVE-2026-81875 assigned