Description
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.12, SHCParser in org.hl7.fhir.r5/src/main/java/org/hl7/fhir/r5/elementmodel/SHCParser.java can enter an infinite loop while processing attacker-controlled Smart Health Card JWT content whose header contains zip: "DEF" and whose raw-DEFLATE payload is empty or truncated. SHCParser.decodeJWT() reaches SHCParser.inflate(), where Inflater.inflate() can return zero while Inflater.finished() remains false and Inflater.needsInput() is true. The loop also lacks an Inflater.needsDictionary() termination check, SHCParser.decompress() contains the same zero-progress pattern, and ResourceChecker.java can reach SHC parsing during file-format detection. A malformed validation request can pin a JVM worker thread indefinitely, and concurrent requests can exhaust all validation workers. This issue is fixed in version 6.9.12.
Published: 2026-09-16
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Patch Immediately
AI Analysis

Impact

A flaw in HAPI FHIR's SHCParser allows an attacker-controlled Smart Health Card JWT that contains a zip: "DEF" header and an empty or truncated raw DEFLATE payload to trigger an infinite loop during parsing. The loop keeps Inflater returning zero progress without indicating completion or the need for a dictionary, effectively pinning a JVM worker thread. When multiple requests are sent, the thread pool can be exhausted, resulting in a denial of service for the validation service. The weakness involves improper input validation, uncontrolled resource consumption, and an infinite loop.

Affected Systems

The vulnerability affects HAPI FHIR's org.hl7.fhir.core library version 6.9.11 and earlier. Any deployment using the library before version 6.9.12 is impacted. The item is part of the HAPI FHIR core implementation used in Java applications that process FHIR resources.

Risk and Exploitability

The CVSS score of 7.5 indicates a high impact, but the EPSS score of less than 1% suggests a very low probability of exploitation in the wild. The vulnerability is not listed in CISA's KEV catalog. Basing on the description, the likely attack vector is remote: an attacker can send crafted validation requests to a server that uses the vulnerable HAPI FHIR library, causing resource exhaustion and service disruption.

Generated by OpenCVE AI on September 17, 2026 at 22:43 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the HAPI FHIR library to version 6.9.12 or later to eliminate the infinite loop bug.
  • If an upgrade cannot be performed immediately, limit or block incoming SHC JWT validation requests, and apply rate limiting to mitigate the risk of exhausting worker threads.
  • Configure the application to enforce a strict maximum on the validation thread pool size and implement timeouts or monitoring to detect and terminate stuck parsing operations.

Generated by OpenCVE AI on September 17, 2026 at 22:43 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-gq9c-wmrm-5hvr HAPI FHIR: SHCParser DEFLATE infinite loop causes denial of service
History

Sat, 19 Sep 2026 23:00:00 +0000

Type Values Removed Values Added
First Time appeared Hapifhir
Hapifhir hl7 Fhir Core
Vendors & Products Hapifhir
Hapifhir hl7 Fhir Core

Thu, 17 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 16 Sep 2026 19:00:00 +0000

Type Values Removed Values Added
Description HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.12, SHCParser in org.hl7.fhir.r5/src/main/java/org/hl7/fhir/r5/elementmodel/SHCParser.java can enter an infinite loop while processing attacker-controlled Smart Health Card JWT content whose header contains zip: "DEF" and whose raw-DEFLATE payload is empty or truncated. SHCParser.decodeJWT() reaches SHCParser.inflate(), where Inflater.inflate() can return zero while Inflater.finished() remains false and Inflater.needsInput() is true. The loop also lacks an Inflater.needsDictionary() termination check, SHCParser.decompress() contains the same zero-progress pattern, and ResourceChecker.java can reach SHC parsing during file-format detection. A malformed validation request can pin a JVM worker thread indefinitely, and concurrent requests can exhaust all validation workers. This issue is fixed in version 6.9.12.
Title HAPI FHIR: SHCParser DEFLATE infinite loop causes denial of service
Weaknesses CWE-20
CWE-400
CWE-835
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Hapifhir Hl7 Fhir Core
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-17T14:02:56.496Z

Reserved: 2026-08-27T17:48:42.121Z

Link: CVE-2026-81876

cve-icon Vulnrichment

Updated: 2026-09-17T14:02:03.329Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-16T19:17:44.450

Modified: 2026-09-30T17:43:24.057

Link: CVE-2026-81876

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-19T22:37:10Z

Weaknesses
  • CWE-20

    Improper Input Validation

  • CWE-400

    Uncontrolled Resource Consumption

  • CWE-835

    Loop with Unreachable Exit Condition ('Infinite Loop')