CVE-2026-113873
SmileCDR HAPI FHIR improper data decompression
- State
- Published
- Severity
- 8.7 High
- Published
- Oct 22, 2026
- Updated
- Oct 26, 2026
- Reserved
- Oct 20, 2026
Description
SmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an unauthenticated attacker to send compressed payloads that exhaust server heap or crash certain services when decompressed.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N | cisa-cg |
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | cisa-cg |
Weaknesses
- CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)
Affected Products
| Product | Versions |
|---|---|
HAPI FHIRSmileCDR |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.