CVE-2026-81876

HAPI FHIR (a Java implementation of the HL7 FHIR healthcare standard) is vulnerable to a denial of service in versions prior to 6.9.12 . The flaw is in SHCParser , where processing a Smart Health Card JWT with a zip: "DEF" header and an empty or truncated raw-DEFLATE payload causes Inflater.infla...

CVE-2026-81875

HAPI FHIR (a Java HL7 FHIR interoperability library) is vulnerable to a denial-of-service via its SHCParser component. When processing attacker-controlled Smart Health Card JWTs containing a zip: "DEF" header with a small raw-DEFLATE payload, the inflate() and decompress() methods accumulate deco...