SmileCDR HAPI FHIR CVE-2026-113873

The affected Smile CDR / HAPI FHIR service must accept and decompress attacker-supplied compressed input (e.g. a gzip/deflate-encoded HTTP request body or compressed FHIR payload) on a network-reachable endpoint; the flaw triggers when that compressed data is expanded during processing. Per CVSS AV:N/AC:L/PR:N/UI:N no authentication, user interaction, or special privilege is required, so default internet- or network-exposed FHIR endpoints that handle compressed payloads are reachable. Limiting factors: the description scopes impact to 'certain services' (only some components crash, not necessarily the whole platform), the endpoint must be exposed to the attacker and must actually decompress untrusted input, and impact is confined to availability - there is no data disclosure or modification. The available sources do not further specify which exact services or compression formats are affected.

The signals are consistent and point to a genuine but single-dimension (availability-only) risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remote, low-complexity, unauthenticated attack with no special attack requirements, and the impact metrics confirm this is purely a denial-of-service issue: VC:N/VI:N (no confidentiality or integrity impact) with VA:H (high availability impact). My independent CVSS 3.1 reading (A:H only, ~7.5) agrees - this is not a code-execution or data-breach flaw, so the 8.7 score reflects easy, unauthenticated reachability against an availability sink rather than broad technical impact. The vuln.today Decision label is 'this_week' (not act_now/emergency), which matches a serious-but-not-fire-drill posture. Key corroborating exploitation signals are MISSING, not negative: no EPSS score is provided, there is no CISA KEV listing, and no PoC/exploit reference appears in the input - so exploitation probability cannot be quantified from this data. CWE-409 (improper handling of highly compressed data, i.e. a decompression/zip-bomb class) aligns with the DoS description. Net: a real priority to patch for availability-sensitive healthcare deployments, but the absence of confidentiality/integrity impact and of any exploitation evidence argues against treating it as an emergency; the 'this_week' label is the appropriate urgency anchor.

A remote, unauthenticated attacker sends a small but highly compressed payload (e.g. a gzip-encoded request body) to an exposed Smile CDR / HAPI FHIR endpoint that decompresses input. On decompression the data expands enormously, exhausting JVM heap and crashing or hanging affected services, denying care-delivery systems access to the FHIR API. No public exploit identified at time of analysis; exploitation requires only the ability to reach a decompressing endpoint, consistent with the AV:N/AC:L/PR:N/UI:N vector.