What’s Vulnerable › Vulnerabilities

CVE-2026-113873: SmileCDR HAPI FHIR improper data decompression

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-22 · updated 2026-10-23
• Weakness: CWE-409

Description

SmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an unauthenticated attacker to send compressed payloads that exhaust server heap or crash certain services when decompressed.

Affected products

• SmileCDR HAPI FHIR: all versions

References

• https://abhinavagarwal07.github.io/posts/hapi-fhir-authorization-findings/
• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-294-01.json
• https://www.cve.org/CVERecord?id=CVE-2026-113873

Get alerted when CVE-2026-113873 or the next vulnerability affects your stack