CVE-2026-81875: HAPI FHIR SHCParser unbounded DEFLATE decompression denial of service

CVE-2026-81875 · Severity: high · CVSS 7.5 · Published 2026-09-16

HAPI FHIR is a widely-used Java library for parsing and validating health data in FHIR format. The SHCParser component, which processes Smart Health Card JWT tokens, lacks limits on decompressed data size. An attacker can submit a small compressed payload that expands to hundreds of megabytes in memory, exhausting heap resources and crashing the application or causing severe performance degradation.

Technologies: ca.uhn.hapi.fhir:org.hl7.fhir.r5 (Maven), ca.uhn.hapi.fhir:org.hl7.fhir.validation (Maven), ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli (Maven). Vendors: Hapi, Maven.

Quick answers

Is CVE-2026-81875 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-81875 being exploited in the wild.
How severe is CVE-2026-81875?
High severity, with a CVSS score of 7.5, published 16 September 2026.
Which products and versions are affected?
Hapi FHIR r5 (org.hl7.fhir.r5); ca.uhn.hapi.fhir:org.hl7.fhir.r5 (Maven) <= 6.9.11, ECOSYSTEM:introduced=0,fixed=6.9.12; ca.uhn.hapi.fhir:org.hl7.fhir.validation (Maven) <= 6.9.11, ECOSYSTEM:introduced=0,fixed=6.9.12; ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli (Maven) <= 5.0.0, ECOSYSTEM:introduced=0,last_affected=5.0.0.
Is there a fix for CVE-2026-81875?
Yes. ca.uhn.hapi.fhir:org.hl7.fhir.r5 (Maven): upgrade to 6.9.12 or later; ca.uhn.hapi.fhir:org.hl7.fhir.validation (Maven): upgrade to 6.9.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-81875 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-81875?
Check whether you run Hapi FHIR, ca.uhn.hapi.fhir:org.hl7.fhir.r5 (Maven), ca.uhn.hapi.fhir:org.hl7.fhir.validation (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • ca.uhn.hapi.fhir:org.hl7.fhir.r5 (Maven): upgrade to 6.9.12 or later
    # set ca.uhn.hapi.fhir:org.hl7.fhir.r5 to 6.9.12 in your pom.xml or build.gradle
  • ca.uhn.hapi.fhir:org.hl7.fhir.validation (Maven): upgrade to 6.9.12 or later
    # set ca.uhn.hapi.fhir:org.hl7.fhir.validation to 6.9.12 in your pom.xml or build.gradle

Technical details

The vulnerability is a classic unbounded decompression attack in the SHCParser.inflate() and decompress() methods. When processing JWT payloads marked with the DEFLATE compression header ("zip":"DEF"), the code decompresses data into a ByteArrayOutputStream without enforcing a maximum output size. Although MAX_ALLOWED_SHC_LENGTH checks the compressed JWT length, this check only logs an error and allows parsing to continue; there is no decompressed-size limit. An attacker can craft a highly compressible JSON payload (achieving 950x+ expansion ratios) and submit it as an SHC JWT. Network-reachable validators or applications accepting attacker-supplied SHC content are vulnerable; no authentication is required. Successful exploitation causes memory exhaustion, OutOfMemoryError, or severe garbage collection pressure, resulting in denial of service.

Affected products

  • HAPI FHIR r5 (org.hl7.fhir.r5)

Identifiers

  • CVE-2026-81875
  • GHSA-3w98-rrpr-fprr

Timeline

  • 2026-09-17: disclosed
  • other: CVE-2026-81875 assigned

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.