CVE-2026-113873High· 7.5▾ TwilightSmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an unauthenticated attacker to send compressed payloads that exhaust server heap or crash certain services when decompressed.
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 23.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
Last analysed / modified upstream
0.3% → 0.5%
SmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an unauthenticated attacker to send compressed payloads that exhaust server heap or crash certain services when decompressed.
hapi_fhir < *Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-113876Medium· 4.3SmileCDR HAPI FHIR unauthorized read
CVE-2026-113874High· 8.1SmileCDR HAPI FHIR trusted tenant partition override
CVE-2026-113875Low· 3.1SmileCDR HAPI FHIR unauthorized read via subscription
CVE-2026-8814Medium· 5.3Versions of the package exifreader before 4.39.0 are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) due to decompressing PNG zTXt metadata without enforcing a built-in maximum decompressed output size
CVE-2026-116662High· 7.5Tanium addressed a compression bomb vulnerability in Enforce.
CVE-2026-65627Medium· 6.9Decompression bomb via unbounded zlib:inflate in jose_jwe_zip:uncompress/2