PT-2026-94396

Name of the Vulnerable Software and Affected Versions AsyncHttpClient versions 2.0.0 through 2.16.0 AsyncHttpClient versions 3.0.0 through 3.0.11 Description Automatic response decompression on the HTTP/1.1 path uses ChannelManager.newHttpContentDecompressor to install Http1ContentDecompressor...

HAPI FHIR: SHCParser unbounded DEFLATE decompression causes denial of service

SHCParser inflates compressed Smart Health Card JWT payloads into memory without a decompressed-size limit. An attacker who can submit SHC content for validation can craft a small compressed JWT payload that expands to a very large byte array, causing memory exhaustion or severe garbage collectio...

HAPI FHIR: SHCParser DEFLATE infinite loop causes denial of service

A malformed Smart Health Card SHC JWT with zip: "DEF" and an empty or truncated DEFLATE payload causes SHCParser.inflate to loop forever. This allows an attacker who can submit SHC content for validation to pin a JVM worker thread indefinitely, causing denial of service...

HAPI FHIR: SHCParser unbounded DEFLATE decompression causes denial of service

SHCParser inflates compressed Smart Health Card JWT payloads into memory without a decompressed-size limit. An attacker who can submit SHC content for validation can craft a small compressed JWT payload that expands to a very large byte array, causing memory exhaustion or severe garbage collectio...

HAPI FHIR: SHCParser DEFLATE infinite loop causes denial of service

A malformed Smart Health Card SHC JWT with zip: "DEF" and an empty or truncated DEFLATE payload causes SHCParser.inflate to loop forever. This allows an attacker who can submit SHC content for validation to pin a JVM worker thread indefinitely, causing denial of service...

HAPI FHIR: SHCParser unbounded DEFLATE decompression causes denial of service

SHCParser inflates compressed Smart Health Card JWT payloads into memory without a decompressed-size limit. An attacker who can submit SHC content for validation can craft a small compressed JWT payload that expands to a very large byte array, causing memory exhaustion or severe garbage collectio...

AlmaLinux 9 : libsoup (ALSA-2026:68234)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:68234 advisory. SoupWebsocketExtensionDeflate: libsoup: libsoup: WebSocket permessage-deflate Unbounded Decompression Remote Denial of Service CVE-2026-15709 libsoup:...

RockyLinux 9 : libsoup (RLSA-2026:68234)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:68234 advisory. SoupWebsocketExtensionDeflate: libsoup: libsoup: WebSocket permessage-deflate Unbounded Decompression Remote Denial of Service CVE-2026-15709 libsoup:...

CVE-2026-81875

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.12, SHCParser in org.hl7.fhir.r5/src/main/java/org/hl7/fhir/r5/elementmodel/SHCParser.java can consume attacker-controlled Smart Health Card JWT content whose header...

CVE-2026-81876 HAPI FHIR: SHCParser DEFLATE infinite loop causes denial of service

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.12, SHCParser in org.hl7.fhir.r5/src/main/java/org/hl7/fhir/r5/elementmodel/SHCParser.java can enter an infinite loop while processing attacker-controlled Smart Health Car...

CVE-2026-81876 HAPI FHIR: SHCParser DEFLATE infinite loop causes denial of service

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.12, SHCParser in org.hl7.fhir.r5/src/main/java/org/hl7/fhir/r5/elementmodel/SHCParser.java can enter an infinite loop while processing attacker-controlled Smart Health Car...

CVE-2026-81876

HAPI FHIR (a Java implementation of the HL7 FHIR healthcare standard) is vulnerable to a denial of service in versions prior to 6.9.12 . The flaw is in SHCParser , where processing a Smart Health Card JWT with a zip: "DEF" header and an empty or truncated raw-DEFLATE payload causes Inflater.infla...

CVE-2026-81876 HAPI FHIR: SHCParser DEFLATE infinite loop causes denial of service

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.12, SHCParser in org.hl7.fhir.r5/src/main/java/org/hl7/fhir/r5/elementmodel/SHCParser.java can enter an infinite loop while processing attacker-controlled Smart Health Car...

CVE-2026-81875

HAPI FHIR (a Java HL7 FHIR interoperability library) is vulnerable to a denial-of-service via its SHCParser component. When processing attacker-controlled Smart Health Card JWTs containing a zip: "DEF" header with a small raw-DEFLATE payload, the inflate() and decompress() methods accumulate deco...

CVE-2026-81875 HAPI FHIR: SHCParser unbounded DEFLATE decompression causes denial of service

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.12, SHCParser in org.hl7.fhir.r5/src/main/java/org/hl7/fhir/r5/elementmodel/SHCParser.java can consume attacker-controlled Smart Health Card JWT content whose header...

CVE-2026-81875

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.12, SHCParser in org.hl7.fhir.r5/src/main/java/org/hl7/fhir/r5/elementmodel/SHCParser.java can consume attacker-controlled Smart Health Card JWT content whose header...

CVE-2026-81875 HAPI FHIR: SHCParser unbounded DEFLATE decompression causes denial of service

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.12, SHCParser in org.hl7.fhir.r5/src/main/java/org/hl7/fhir/r5/elementmodel/SHCParser.java can consume attacker-controlled Smart Health Card JWT content whose header...

CVE-2026-81875 HAPI FHIR: SHCParser unbounded DEFLATE decompression causes denial of service

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.12, SHCParser in org.hl7.fhir.r5/src/main/java/org/hl7/fhir/r5/elementmodel/SHCParser.java can consume attacker-controlled Smart Health Card JWT content whose header...

Moderate: Red Hat Security Advisory: libsoup security update

An update for libsoup is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

SoupWebsocketExtensionDeflate: libsoup: libsoup: WebSocket permessage-deflate Unbounded Decompression Remote Denial of Service

A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension. The extension's decompression loop inflate processes data in chunks without enforcing an upper boundary limit on the output buffer size. While libsoup limits the incoming compressed frame size via...