CVE-2026-81876: HAPI FHIR: SHCParser DEFLATE infinite loop causes denial of service
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.12, SHCParser in org.hl7.fhir.r5/src/main/java/org/hl7/fhir/r5/elementmodel/SHCParser.java can enter an infinite loop while processing attacker-controlled Smart Health Card JWT content whose header contains zip: "DEF" and whose raw-DEFLATE payload is empty or truncated. SHCParser.decodeJWT() reaches SHCParser.inflate(), where Inflater.inflate() can return zero while Inflater.finished() remains false and Inflater.needsInput() is true. The loop also lacks an Inflater.needsDictionary() termination check, SHCParser.decompress() contains the same zero-progress pattern, and ResourceChecker.java can reach SHC parsing during file-format detection. A malformed validation request can pin a JVM worker thread indefinitely, and concurrent requests can exhaust all validation workers. This issue is fixed in version 6.9.12.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
HAPI FHIR (SHCParser)to a version that resolves this vulnerability.Fixed in 6.9.12 - Compensating control
Mitigate denial of service from malformed validation requests by adding external rate limiting/traffic throttling for requests that trigger Smart Health Card JWT parsing, since malformed Smart Health Card content can pin JVM worker threads and exhaust validation workers.
Event History
Frequently Asked Questions
Which deployments are exposed to this denial of service?
Deployments using HAPI FHIR versions before 6.9.12 are affected if they process attacker-controlled Smart Health Card JWT content or perform file-format detection that can reach SHC parsing. A malformed validation request can indefinitely occupy a JVM validation worker thread.
What does an attacker need to send to trigger the issue?
The attacker needs to supply a Smart Health Card JWT with a header containing zip: "DEF" and an empty or truncated raw-DEFLATE payload. No authentication or user interaction is required according to the reported vector.
How can this affect service availability?
A single malformed request can pin a JVM worker thread in an infinite loop. Concurrent malformed requests can exhaust all validation workers and prevent the service from processing legitimate validation work.
What should be done to remediate the issue?
Upgrade HAPI FHIR to version 6.9.12, which fixes the issue. The provided data does not identify a workaround for deployments that cannot immediately upgrade.