https://vulnerability.circl.lu/sightings/feed 2026-09-18T13:20:21.554612+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/ebd1ee87-904a-4a38-af61-4f61a4c9f91c/export 2026-09-18T13:20:21.616468+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "ebd1ee87-904a-4a38-af61-4f61a4c9f91c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-81876", "type": "seen", "source": "https://gist.github.com/alon710/ccdbb258ac65bfe162fcd19f3dfec9e5", "content": "# CVE-2026-81876: CVE-2026-81876: Unauthenticated Denial of Service via Infinite Loop in HAPI FHIR SHCParser\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-09-17\n> **Full Report:** https://cvereports.com/reports/CVE-2026-81876\n\n## Summary\nCVE-2026-81876 is a high-severity Denial of Service vulnerability in HAPI FHIR, a complete Java implementation of the HL7 FHIR standard. The vulnerability stems from improper usage of Java's java.util.zip.Inflater class within the Smart Health Card (SHC) parser.\n\n## TL;DR\nAn unauthenticated remote attacker can trigger an infinite loop in the JVM by submitting a malformed JSON Web Token representing a Smart Health Card. This loop pins the worker thread at 100% CPU, leading to potential complete application Denial of Service.\n\n## Technical Details\n\n- **CWE ID**: CWE-835 / CWE-400\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 7.5 (High)\n- **EPSS Score**: 0.0063\n- **Impact**: Denial of Service (DoS)\n- **Exploit Status**: Theoretical / Unproven\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- HAPI FHIR core library (org.hl7.fhir.core)\n- **org.hl7.fhir.core**: < 6.9.12 (Fixed in: `6.9.12`)\n\n## Mitigation\n\n- Upgrade HAPI FHIR core to version 6.9.12 or newer.\n- Configure Web Application Firewall (WAF) rules to detect and drop payloads containing DEFLATE headers in JWS structures.\n- Restrict input stream size to mitigate decompression bomb risks.\n\n**Remediation Steps:**\n1. Identify dependencies on 'org.hl7.fhir.core' and related 'org.hl7.fhir.r5' modules within build configurations.\n2. Update the dependency version to 6.9.12.\n3. Rebuild and execute automated tests to verify standard FHIR processing functionality remains intact.\n4. Deploy the updated application artifact to staging and production environments.\n\n## References\n\n- [GitHub Security Advisory GHSA-gq9c-wmrm-5hvr](https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-gq9c-wmrm-5hvr)\n- [Fix Commit d804558b](https://github.com/hapifhir/org.hl7.fhir.core/commit/d804558bd77372b1629e55a5b901cad3f5134cdc)\n- [Fix Commit edd5d8c1](https://github.com/hapifhir/org.hl7.fhir.core/commit/edd5d8c139e669e39270785f08be7b63aefef24c)\n- [Fix Pull Request #2493](https://github.com/hapifhir/org.hl7.fhir.core/pull/2493)\n- [NVD Vulnerability Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-81876)\n- [CVE Authority Record](https://www.cve.org/CVERecord?id=CVE-2026-81876)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-81876) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-18T10:32:02.368986Z"} 2026-09-18T10:32:02.368986+00:00 https://vulnerability.circl.lu/sighting/c52bfd00-1a53-4651-bfe8-fae7a504aa18/export 2026-09-18T13:20:21.619081+00:00 Joseph Lee https://vulnerability.circl.lu/user/syspect {"uuid": "c52bfd00-1a53-4651-bfe8-fae7a504aa18", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-81876", "type": "published-proof-of-concept", "source": "https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-gq9c-wmrm-5hvr", "content": "", "creation_timestamp": "2026-09-17T22:35:19.341081Z"} 2026-09-17T22:35:19.341081+00:00