CVE-2026-113873CWE-409

CVE-2026-113873

High · published October 22, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
26.7
In the wild
Unconfirmed
What it is

SmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an unauthenticated attacker to send compressed payloads that exhaust server heap or crash certain services when decompressed.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00344 · 26.7th percentile
Weakness
CWE-409 · Improper Handling of Highly Compressed Data (Data Amplification)
Published
2026-10-22T22:17Z
References (3)
https://abhinavagarwal07.github.io/posts/hapi-fhir-authorization-findings/ · 9119a7d8-5eab-497f-8521-727c672e3725https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-294-01.json · 9119a7d8-5eab-497f-8521-727c672e3725https://www.cve.org/CVERecord?id=CVE-2026-113873 · 9119a7d8-5eab-497f-8521-727c672e3725
EPSS history
Timeline
  • 24 OCT 03:52Z
    EPSS moved — → 0%
    epss
  • 22 OCT 17:57Z
    SmileCDR HAPI FHIR improper data decompression
    cvelistv5
  • 22 OCT 17:57Z
    SmileCDR HAPI FHIR improper data decompression
    cvelistv5