THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-gq9c-wmrm-5hvr (high) — HAPI FHIR: SHCParser DEFLATE infinite loop causes denial of service

[GHSA] GHSA-gq9c-wmrm-5hvr (high) — HAPI FHIR: SHCParser DEFLATE infinite loop causes denial of service

medgithub_advisoriesPublished 2026-09-17

GHSA-gq9c-wmrm-5hvr Severity: high CVE: CVE-2026-81876

HAPI FHIR: SHCParser DEFLATE infinite loop causes denial of service

### Summary A malformed Smart Health Card (SHC) JWT with `zip: "DEF"` and an empty or truncated DEFLATE payload causes `SHCParser.inflate()` to loop forever. This allows an attacker who can submit SHC content for validation to pin a JVM worker thread indefinitely, causing de

Indicators of compromise

CVE-2026-81876cve

Original source: https://github.com/advisories/GHSA-gq9c-wmrm-5hvr