Executive brief
HAPI FHIR is a healthcare data library used to validate and process medical records in standards-compliant formats. A malformed Smart Health Card (digital health credential) with a compressed payload can cause the validation process to hang indefinitely, freezing a worker thread. An attacker submitting multiple malformed cards could exhaust all validation workers, making the entire validation service unavailable.
Technical details
The vulnerability is an infinite loop in the SHCParser.inflate() method (lines 455–468 in SHCParser.java) caused by unsafe decompression logic. When a JWT contains zip: "DEF" (DEFLATE compression) but the payload is empty or truncated, the Inflater.inflate() call returns 0 bytes, finished() remains false, and the loop condition never exits. The vulnerable code does not check needsInput() or needsDictionary(), and does not detect zero-progress states. The same unsafe pattern exists in the decompress() method. An unauthenticated attacker can trigger this path by submitting malformed SHC content (.shc files or shc:// URIs) to a validator; the vulnerability is also reachable during file-format detection. A single request hangs indefinitely; multiple concurrent requests exhaust worker threads and cause denial of service.
Affected products
- HAPI FHIR HAPI FHIR <unknown
Timeline
- 2026-09-17: disclosed
- other: CVE-2026-81876 assigned