Infinite Loop Vulnerability in HAPI FHIR for Healthcare Interoperability

CVE-2026-81876

What is CVE-2026-81876?

The HAPI FHIR library, an implementation of the HL7 FHIR standard for healthcare interoperability in Java, suffers from an infinite loop vulnerability within the SHCParser component. When processing Smart Health Card JWTs that have a specific malformed header and an empty or truncated payload, the SHCParser.decodeJWT() function can enter a continuous loop due to erroneous conditions in the Inflater class. This flaw prevents JVM worker threads from completing their tasks, potentially exhausting all validation workers and leading to service outages. This vulnerability has been addressed in version 6.9.12.

References