CVE-2026-113873: SmileCDR HAPI FHIR improper data decompression
SmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an unauthenticated attacker to send compressed payloads that exhaust server heap or crash certain services when decompressed.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated remote attacker can exploit it by sending a highly compressed payload to a vulnerable SmileCDR HAPI FHIR deployment. No privileges or user interaction are required.
What is the likely impact on an affected deployment?
Decompression of the crafted payload can exhaust server heap memory or crash certain services, resulting in denial of service. The provided information identifies availability impact only; it does not indicate confidentiality or integrity impact.
How difficult is exploitation?
The supplied severity vector rates attack complexity as low and the attack vector as network-based. This indicates exploitation does not require complex preconditions beyond reaching a vulnerable service.