Heap Exhaustion Vulnerability in SmileCDR HAPI FHIR Product by Smile CDR
CVE-2026-113873

8.7HIGH

Key Information:

Vendor

Smilecdr

Status
Hapi Fhir
Vendor
CVE Published:
22 October 2026

What is CVE-2026-113873?

The SmileCDR HAPI FHIR product has a vulnerability that allows attackers to exploit how the software handles highly compressed data. By sending specific compressed payloads, an unauthenticated attacker can lead the system to exhaust its heap memory or cause certain services to crash during decompression. This can severely disrupt the application’s functionality, posing a significant risk to system integrity and availability.

Affected Version(s)

HAPI FHIR 0

References

https://raw.githubusercontent.com/cisagov/CSAF/develop/cs...
third-party-advisory
https://www.cve.org/CVERecord?id=CVE-2026-113873
vdb-entry

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abhinav Agarwal
.