CVE-2026-113873 in HAPI FHIR
Summary
by MITRE • 10/22/2026
SmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an unauthenticated attacker to send compressed payloads that exhaust server heap or crash certain services when decompressed.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability in SmileCDR and the underlying HAPI FHIR library represents a significant resource exhaustion risk stemming from improper handling of highly compressed input data. This flaw allows an unauthenticated remote attacker to exploit the server's decompression mechanisms by submitting specially crafted payloads that are extremely small when compressed but expand into massive amounts of data upon decompression. The core technical issue lies in the absence or insufficiency of limits on the expansion ratio between compressed and uncompressed data, as well as a lack of strict constraints on the total size of the decompressed content before it is processed by the application logic. When such payloads are received, the server allocates memory to hold the expanded data, leading to rapid consumption of available heap space or triggering out-of-memory conditions that cause critical services to crash.
From an operational perspective, this vulnerability directly impacts the availability and stability of FHIR-based healthcare information systems. By sending these compressed requests, an attacker can induce a Denial of Service condition without needing valid credentials, effectively rendering the system inaccessible to legitimate users who rely on it for patient data exchange. The impact is particularly severe in environments where SmileCDR serves as a central hub or server component, as the crash of specific services may disrupt broader workflows involving electronic health record access and interoperability standards compliance. This type of attack exploits the computational cost associated with decompression algorithms, turning a standard feature into an avenue for resource starvation attacks that can take down infrastructure if not properly mitigated through configuration hardening or patching.
This vulnerability aligns closely with CWE-409, which describes the exploitation of highly compressed data to cause memory exhaustion, and falls under the broader category of inefficient resource management often seen in web applications handling user-supplied input. In terms of offensive security frameworks, this behavior is consistent with ATT&CK technique T1496, Resource Hijacking, specifically within the context of Denial of Service via resource consumption. The attack vector leverages the trust placed in incoming data streams and the default behaviors of decompression libraries that prioritize functionality over safety limits by default.
To mitigate this risk, organizations must ensure they are running a patched version of SmileCDR or HAPI FHIR where appropriate safeguards have been implemented to limit compression ratios and maximum payload sizes. Configuration changes should include setting strict upper bounds on the size of decompressed data allowed in memory before processing begins. Additionally, implementing network-level rate limiting and input validation can help detect and block anomalous traffic patterns associated with such attacks. Security teams should also monitor server heap usage metrics for sudden spikes that may indicate ongoing exploitation attempts and consider deploying web application firewalls configured to inspect content encoding headers and payload sizes prior to reaching the application layer.