CVE-2026-113873High· 7.5▾ TwilightSmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an unauthenticated attacker to send compressed payloads that exhaust server heap or crash certain services when decompressed.
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
SmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an unauthenticated attacker to send compressed payloads that exhaust server heap or crash certain services when decompressed.
hapi_fhir < *Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-113876Medium· 4.3SmileCDR HAPI FHIR unauthorized read
CVE-2026-113874High· 8.1SmileCDR HAPI FHIR trusted tenant partition override
CVE-2026-113875Low· 3.1SmileCDR HAPI FHIR unauthorized read via subscription
CVE-2026-8814Medium· 5.3Versions of the package exifreader before 4.39.0 are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) due to decompressing PNG zTXt metadata without enforcing a built-in maximum decompressed output size
CVE-2026-115638Medium· 4.3OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka a gzip bomb.
CVE-2026-115503Medium· 5.5Ghidra before 12.2 Denial of Service via Compressed Extension Archive