This flaw occurs when SmileCDR HAPI FHIR decompresses overly large or highly compressed data without properly checking the resulting size. An unauthenticated attacker can send a crafted compressed payload that, when decompressed, consumes excessive heap memory or causes the server to crash. The failure to enforce a limit on decompressed data size leads to a denial‑of‑service condition for the affected services.

The vulnerability is known to affect applications that use the SmileCDR HAPI FHIR component. No specific product versions are listed, so any deployment that incorporates this library is potentially impacted until a fix is applied.

The CVSS score of 8.7 indicates a high‑severity condition, and while the EPSS score is not available, the lack of KEV listing does not reduce the risk of exploitation. The flaw can be triggered remotely by sending a specially crafted compressed request, and because it does not require authentication, the exploitation window is wide. The impact is available to any attacker who can reach the affected endpoint and may result in service interruption or application crash.