https://vulnerability.circl.lu/sightings/feed 2026-09-18T22:01:25.162926+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/da9156d9-6145-4bc8-857c-6ab59132a737/export 2026-09-18T22:01:25.196448+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "da9156d9-6145-4bc8-857c-6ab59132a737", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-81875", "type": "seen", "source": "https://gist.github.com/alon710/839e5670d8770ce9ac0c8d550d9e25b4", "content": "# CVE-2026-81875: CVE-2026-81875: Unbounded DEFLATE Decompression Denial of Service in HAPI FHIR SHCParser\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-09-17\n> **Full Report:** https://cvereports.com/reports/CVE-2026-81875\n\n## Summary\nA critical denial of service vulnerability exists in the HAPI FHIR SHCParser within the org.hl7.fhir.core Java library. Unbounded decompression of raw DEFLATE data during Smart Health Card parsing allows unauthenticated remote attackers to trigger JVM heap exhaustion and crash the application.\n\n## TL;DR\nUnbounded DEFLATE decompression in HAPI FHIR SHCParser allows remote attackers to cause JVM OutOfMemory crashes via malformed Smart Health Card payloads.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-409 (Improper Handling of Highly Compressed Data)\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1**: 7.5 (High)\n- **EPSS Score**: 0.0063 (Percentile: 48.59%)\n- **Impact**: Denial of Service (DoS) via JVM Heap Exhaustion\n- **Exploit Status**: Proof of Concept (PoC) Available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Applications running Java with the HAPI FHIR core libraries (org.hl7.fhir.core) parsing Smart Health Cards (SHC).\n- Vaccination validation portals and clinical verification services that process health card JWTs.\n- **org.hl7.fhir.core**: < 6.9.12 (Fixed in: `6.9.12`)\n\n## Mitigation\n\n- Upgrade HAPI FHIR dependencies to version 6.9.12 or later.\n- Implement request size filtering and JWT validation in API Gateways.\n- Configure Web Application Firewall rules to block JWT payloads using DEFLATE compression if not explicitly required.\n- Set explicit JVM constraints to restart the server automatically on OutOfMemoryError.\n\n**Remediation Steps:**\n1. Identify all projects and microservices using HAPI FHIR core (org.hl7.fhir.core).\n2. Update the dependency version in pom.xml or build.gradle to 6.9.12.\n3. Rebuild the application and execute integration tests using the provided PoC structure to verify successful protection.\n4. Deploy the updated applications and configure container orchestrators to handle JVM crashes safely during transition periods.\n\n## References\n\n- [GitHub Security Advisory GHSA-3w98-rrpr-fprr](https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-3w98-rrpr-fprr)\n- [NVD CVE-2026-81875 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-81875)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-81875) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-18T11:31:11.772871Z"} 2026-09-18T11:31:11.772871+00:00 https://vulnerability.circl.lu/sighting/0dee29c5-7f77-4210-ba73-02e16420a3a2/export 2026-09-18T22:01:25.199902+00:00 Joseph Lee https://vulnerability.circl.lu/user/syspect {"uuid": "0dee29c5-7f77-4210-ba73-02e16420a3a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-81875", "type": "published-proof-of-concept", "source": "https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-3w98-rrpr-fprr", "content": "", "creation_timestamp": "2026-09-17T22:35:21.222383Z"} 2026-09-17T22:35:21.222383+00:00