{"id":"CVE-2026-81876","summary":"HAPI FHIR: SHCParser DEFLATE infinite loop causes denial of service","details":"HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.12, SHCParser in org.hl7.fhir.r5/src/main/java/org/hl7/fhir/r5/elementmodel/SHCParser.java can enter an infinite loop while processing attacker-controlled Smart Health Card JWT content whose header contains zip: \"DEF\" and whose raw-DEFLATE payload is empty or truncated. SHCParser.decodeJWT() reaches SHCParser.inflate(), where Inflater.inflate() can return zero while Inflater.finished() remains false and Inflater.needsInput() is true. The loop also lacks an Inflater.needsDictionary() termination check, SHCParser.decompress() contains the same zero-progress pattern, and ResourceChecker.java can reach SHC parsing during file-format detection. A malformed validation request can pin a JVM worker thread indefinitely, and concurrent requests can exhaust all validation workers. This issue is fixed in version 6.9.12.","aliases":["GHSA-gq9c-wmrm-5hvr"],"modified":"2026-09-19T08:01:53.057161Z","published":"2026-09-16T18:48:05.161Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-20","CWE-400","CWE-835"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81876.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81876.json"},{"type":"ADVISORY","url":"https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-gq9c-wmrm-5hvr"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81876"},{"type":"FIX","url":"https://github.com/hapifhir/org.hl7.fhir.core/commit/d804558bd77372b1629e55a5b901cad3f5134cdc"},{"type":"FIX","url":"https://github.com/hapifhir/org.hl7.fhir.core/commit/edd5d8c139e669e39270785f08be7b63aefef24c"},{"type":"FIX","url":"https://github.com/hapifhir/org.hl7.fhir.core/pull/2493"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/hapifhir/org.hl7.fhir.core","events":[{"introduced":"0"},{"fixed":"d804558bd77372b1629e55a5b901cad3f5134cdc"},{"fixed":"edd5d8c139e669e39270785f08be7b63aefef24c"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"6.9.12"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["6.9.10","6.9.9","6.9.8","6.9.4","6.9.7","6.9.6","6.9.5","6.9.3","6.9.2","6.9.1","6.9.0","6.8.1","6.8.2","6.7.11"],"database_specific":{"vanir_signatures":[{"digest":{"line_hashes":["136091072841199814584600333235394192435","165379091231531327191037505422476647305","198789399721221590355629323650232563440","275816897020629936955594082648943964674"],"threshold":0.9},"id":"CVE-2026-81876-3a98afaf","signature_type":"Line","signature_version":"v1","source":"https://github.com/hapifhir/org.hl7.fhir.core/commit/edd5d8c139e669e39270785f08be7b63aefef24c","target":{"file":"org.hl7.fhir.r5/src/main/java/org/hl7/fhir/r5/elementmodel/SHCParser.java"},"deprecated":false},{"digest":{"function_hash":"18839149240940587579755882218920224579","length":417},"id":"CVE-2026-81876-420bfe02","signature_type":"Function","signature_version":"v1","source":"https://github.com/hapifhir/org.hl7.fhir.core/commit/d804558bd77372b1629e55a5b901cad3f5134cdc","target":{"file":"org.hl7.fhir.r5/src/main/java/org/hl7/fhir/r5/elementmodel/SHCParser.java","function":"inflate"},"deprecated":false},{"digest":{"line_hashes":["248695994930844270623345794537721138600","242350028416348921707693889436771816538","307884469190616749103350843699781650460","179296319229756190854698115056508270426","307304639314427034771982738908839701352","321117442842633779088041005344091187763","236155350623004564772955133715080112454","59491841888848638381385312230356343166","21635448137040465900106586550405032693","205326504783230533214935867936017509298","3321802746571485248706140686975015475","62637192576112550678168940375276670563","292514155997970735518944046979995102303","103328783821289403319936069066246416524","226609199597327081789845469128947725642","47675917517503912206024759328983310524","305492439982880913018334059526904727225","248069438216438958792996054716072203422","21742261867020054605534948775240979796","202337624970108253969030168272692186974","312808831754347806702016830764497004076","98153370962378166885394507648174347382","263815925963041249680076348016285129472","282547939738913338029303085480387011285","29528756370066919081268106748558373459","121990286572409183536866599972866879785","184889171164714708311850184973179558209","99847997217147317007103336125288692799","37247187780111493681252230564198971356","327165635212047104271098953672998571738","200041505608340668554900387456196272150","335104248080334717405151586375769684020","93584992763038360516678142923629016819","98449364508374466163873323752441554841","128378937844086176290664756438357445023","283211731319682150406371135307689410158","39970630947978156468112917438810955187","163833774467557798633575928494035512624","297728980409947309172132339434040068520","123635858124047018212352312312089170695","76440611726429308302876859466302271304","90228861974006130549443794064732113622","259199776313105174732420113066562416355","79867744050719465286178812259888179918","194891166734768658959612897172837256150","48987437230196894783046369219295080501","324501066445918260293530254918071870797","176452404258258919480276684517611630991","156710186499009805548203295421283843565","110676485410389961797437785258219710111","146543730120653114939143763570323142415","121530301695944464924378890794043404863","124680288562671483102091760596365246151","33695723627737050972833778006378378268","238421399177058972299912263323151891040","294838328114009735281758653822024828511","31518707179640245501884021784448692207","32462131002669750525426374129013965317","267456180609794909498254015611567511939","194267944737814578806183151326703926955","325654331236226857051970107463802169268","3122412289178773275857494421872677420","6534214219303449796059355186080395339","31438142343192612320545138633264175850","95512320775011509057038798021420926491","3140357393243912384588125446753037732","122689862978487678086261203722614079392","295256761263320644299116380421796055275","158857946082338675157183504720146512417","232865299244916352127154366268396915883","204552518769517708696991047092889853957","245094323685104427936767739878485150326","290613540837769976534952253713640906006","280294352561879784910504333741723364730","190231686230384665179922895202126504333","29880059195366217297574163936530877910","207886187563458849861599424974269391573","68127394106600060477950604629933029470","274207077265583769772506529798713991959","109555021446199626354946475299960644201","82781599271439511081396403732771327770","116474380684545878203858261578474402240","252557474420439003974577724618871483986","82773281451143824531793785717128619575","157956077224505734074014598869310519870","57008404959712781017866570378063423401","222203433649520289104708760644034146913","250659121031893173661777996030979456061","213090504520590419932536183415975281937","67850059393013800143063384267304453517","180806002855088078105397236074929034317","335445571853673013253693706997686125288","141004327126886540582025290743885726704","182652916143382107181602608660753622241","42267685206534870068646048743832298700","20357410981571250532398403243823662004","92160839597108836554919548133311731892","144120593407686853174366950503435699099","277820987726711823787295893955984946395","279089316071054795061998715935008676626","179508099097712742462291416937405034616","284029065063019862694626558505664829261","169453998579705309246197364202248918176","109740843713801797916813147864654141852","217229038304788262877871196087822727772","195733704991904073882544340895314993272","155962659000556498805635530918391449535","201872125081281151076721923412895668950","107101661700436168361152141496207471134","270649621876696143585358143332013269034","132035350739460206180056579486280396345","220509560886525351190340896704724579638","163273407306536812255679591903018956805","72509342812456577015681976898084971449","45188175090907244134749910457508001353","31998420961931674778356871939662241552","135825433612844632036732640758446051258","248135651399306752499873760262860024874","295895945224117527942029734079316597095","63590665699994093561027766642500620513","165729535943242776619170201481436945957","248730747835895967176056776184959522836","319530573794353203020506198418285151825","286306830064022929681839434949506705972","242004639244235834027941061373997016636","57341704752578957777387689207938977249","1234876456293521869102459325144535454","128990638929776835500560467210936475250","337839760356034249259899977857307040012","56681648385414781100800527825844488135","117744035722306011145092666998982035969","60349181461032040271355157162372606454","164655553813206402296036348454886218372","314421953025468419181368687383407338232","307026425275610467014620198661122387228","113656519590355612755363090489728081974","187603285636115201665541994970070662530","34810195814726527439329641392946547094","13002227551785266389454538752152448319","9587482503033684487455977692062671210","266047773827909335120004992634289688779","160804125628458095139204788226341405633","26391454750420720273308132743327472149","323769006251843390073409154618969666238"],"threshold":0.9},"id":"CVE-2026-81876-518cfb29","signature_type":"Line","signature_version":"v1","source":"https://github.com/hapifhir/org.hl7.fhir.core/commit/d804558bd77372b1629e55a5b901cad3f5134cdc","target":{"file":"org.hl7.fhir.r5/src/main/java/org/hl7/fhir/r5/elementmodel/SHCParser.java"},"deprecated":false},{"source":"https://github.com/hapifhir/org.hl7.fhir.core/commit/edd5d8c139e669e39270785f08be7b63aefef24c","target":{"file":"org.hl7.fhir.r5/src/main/java/org/hl7/fhir/r5/elementmodel/SHCParser.java","function":"decompress"},"deprecated":false,"digest":{"function_hash":"100455929716093015251610219707593334546","length":411},"id":"CVE-2026-81876-88364606","signature_type":"Function","signature_version":"v1"}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-81876.json","vanir_signatures_modified":"2026-09-19T08:01:53Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}