HAPI FHIR: Denial of service via highly compressed request bodies
Summary
HAPI FHIR, the open-source Java FHIR implementation used by Smile CDR and other products, does not limit how far gzip-compressed request bodies are expanded. An unauthenticated remote attacker can send small compressed payloads that expand to very large sizes, exhausting server heap memory or crashing services. The expansion happens before the authorization check, so no credentials are needed. Impact is limited to availability; confidentiality and integrity are not affected according to the scores.
Affected
- SmileCDR HAPI FHIR, all versions according to the CNA record (vers:all/*)
- Tested by the researcher on HAPI FHIR 8.10.0; source inspection also found the issue in v8.8.2, v8.10.1 and v8.12.1
- Smile CDR 2026.05.R01 is based on HAPI FHIR 8.10.0
- Default configuration: inbound gzip decompression is enabled
Fixed in
Unknown.
- No fixed version has been published in the sources reviewed; CISA lists no fix.
- The vendor reportedly plans a fix in its November release; this is second-hand and unconfirmed.
Workaround
- No vendor-documented workaround found.
- Check whether inbound decompression can be disabled or limited in your deployment; confirm the exact setting with the vendor before changing production systems.
- Limit request body size and decompressed size at a reverse proxy or WAF where possible.
Exploitation
- Not marked as known exploited in the sources reviewed.
- Public proof of concept: unknown.
- The researcher reproduced the issue in a test harness.
Our recommendation
- Check whether any HAPI FHIR-based product or custom FHIR service in your environment is in use, including products that embed HAPI FHIR.
- Do not expose FHIR endpoints to the internet; restrict access to known clients.
- Apply request size and decompression limits at a reverse proxy or WAF.
- Monitor for unusually large or highly compressed requests and for service restarts or memory exhaustion.
- Install the vendor fix as soon as it is available and verify the fixed version with the vendor or the CISA advisory VA-26-294-01.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE record CVE-2026-113873 www.cve.org
- CISA CSAF advisory VA-26-294-01 raw.githubusercontent.com
- Researcher write-up: Four Authorization and Availability Findings in HAPI FHIR abhinavagarwal07.github.io
- oss-security researcher post openwall.com
- HIPAA Journal: HAPI FHIR vulnerabilities and Smile CDR www.hipaajournal.com
- HOL Guard CVE details hol.org
- Strix CVE details www.strix.ai
- VulDB entry 425356 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 00:42.
Original description (NVD)
SmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an unauthenticated attacker to send compressed payloads that exhaust server heap or crash certain services when decompressed.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.