{"id":"CVE-2026-113873","published":"2026-10-22T18:17:27.077","lastModified":"2026-10-23T19:17:43.350","description":"SmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an unauthenticated attacker to send compressed payloads that exhaust server heap or crash certain services when decompressed.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-409"],"vendors":[],"products":[],"references":[{"url":"https://abhinavagarwal07.github.io/posts/hapi-fhir-authorization-findings/","tags":[]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-294-01.json","tags":[]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-113873","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}