CVE-2026-113873

SmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an unauthenticated attacker to send compressed payloads that exhaust server heap or crash certain services when decompressed.

CVSS 4.0

8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.5% chance of exploitation in the next 30 days; higher than 44% of CVEs (scores of 2026-10-25)

CWE

CWE-409

Published

2026-10-22

Modified

2026-10-23

Record from

the NVD, synced 2026-10-24

References

• https://abhinavagarwal07.github.io/posts/hapi-fhir-authorization-findings/
• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-294-01.json
• https://www.cve.org/CVERecord?id=CVE-2026-113873

Check your stackJSON