Vulnerability Description
SmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an unauthenticated attacker to send compressed payloads that exhaust server heap or crash certain services when decompressed.
CVSS Score
7.5
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Related Weaknesses (CWE)
References
- https://abhinavagarwal07.github.io/posts/hapi-fhir-authorization-findings/
- https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/
- https://www.cve.org/CVERecord?id=CVE-2026-113873
FAQ
What is CVE-2026-113873?
CVE-2026-113873 is a vulnerability with a CVSS score of 7.5 (HIGH). SmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an unauthenticated attacker to send compressed payloads that exhaust server heap or crash certain services when decompresse...
How severe is CVE-2026-113873?
CVE-2026-113873 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-113873?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.