CVE-2026-113873
HighCVSS 7.5Summary
SmileCDR HAPI FHIR does not properly handle highly compressed data. An unauthenticated attacker can send compressed payloads that exhaust server heap or crash certain services when decompressed.
Risk Assessment
A denial-of-service attack can make FHIR services unavailable. This affects the availability of the medical data exchange system.
Recommendation
Apply the fix or enforce limits on incoming payload size and compression ratio as recommended by the vendor. Monitor for unusual memory and compression usage.
Other vulnerabilities in SmileCDR HAPI FHIR
See all- CVE-2026-113876Medium
SmileCDR HAPI FHIR does not correctly check authorization for conditional create actions. A user with CREATE but not READ permissions could submit a conditional create whose predicate matches an existing resource and receive the target resource's contents.
- CVE-2026-113875Low
On a SmileCDR HAPI FHIR server with REST-hook subscriptions enabled, a user granted subscription-creation permissions may be able to query and read resources they are not otherwise permitted to access. The flaw stems from insufficient authorization checks on subscriptions.
- CVE-2026-113874High
SmileCDR HAPI FHIR allows an untrusted bundle body to replace a partition identity previously established by a trusted source and does not enforce storage partition entitlement by default. An attacker authorized for one tenant can read from or write to another tenant's partition.
Original NVD description (English source)
SmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an unauthenticated attacker to send compressed payloads that exhaust server heap or crash certain services when decompressed.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS