SB2026090137 - Multiple vulnerabilities in FHIR
Published: September 1, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 vulnerabilities.
1) Improper handling of highly compressed data (CVE-ID: CVE-2026-81875)
CWE-ID: CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper handling of highly compressed data in SHCParser when validating attacker-supplied smart health card content with a DEF-compressed JWT payload. A remote attacker can submit a specially crafted compressed JWT payload to cause a denial of service.
Applications that accept smart health card content for validation are affected, and exploitation can cause memory exhaustion, severe garbage collection pressure, request failure, or process termination.
2) Infinite loop (CVE-ID: CVE-2026-81876)
CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to loop with an unreachable exit condition in SHCParser.inflate() and SHCParser.decompress() when processing SHC content containing an empty or truncated DEFLATE payload with zip: \"DEF\". A remote attacker can submit specially crafted SHC content for validation to cause a denial of service.
The issue is reachable during SHC validation and during file-format detection for SHC-looking input, and a single malformed validation request can pin a JVM worker thread indefinitely.
Remediation
Install update from vendor's website.