CVE-2026-113873

{
  "etk_id": "ETK-2026-2477",
  "cve_id": "CVE-2026-113873",
  "display_id": "CVE-2026-113873",
  "ghsa_id": "GHSA-36fr-h72x-63ph",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "anchored",
  "title": "Improper compressed-data handling in SmileCDR HAPI FHIR",
  "summary": "SmileCDR HAPI FHIR improperly processes highly compressed input. An unauthenticated attacker able to submit compressed payloads can cause excessive heap consumption or crash certain services when the input is decompressed.",
  "mitigation": "Update HAPI FHIR to version *. Restrict untrusted access to endpoints that accept compressed payloads until the update is deployed.",
  "vendor": "SmileCDR",
  "product": "HAPI FHIR",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < *"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "*"
      ],
      "package_name": "HAPI FHIR",
      "purl": null
    }
  ],
  "cwes": [
    409
  ],
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 20.597021233333333,
  "t0_at": "2026-10-22T17:57:52.475000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-22T18:29:57.155415+00:00",
      "days": 0.02227639369212963,
      "is_lower_bound": false,
      "measured_at": "2026-10-22T17:57:52.475000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-22T17:57:52.475000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-22T17:57:52.475000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-113873"
    }
  }
}