CVE-2026-113873
High · 7.5CVSS
7.5
EPSS
0.5%
Published
Oct 22, 2026
CISA due date
—
The record
SmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an unauthenticated attacker to send compressed payloads that exhaust server heap or crash certain services when decompressed.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-118761 Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning… CWE-409
- CVE-2026-118261 Echo is a Go web framework. CWE-409
- CVE-2026-111073 The broker-side PushTelemetry API (KIP-714) validates only the compressed size of a… CWE-409
- CVE-2026-116662 Tanium addressed a compression bomb vulnerability in Enforce. CWE-409
- CVE-2026-116579 Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted… CWE-409
- CVE-2026-65627 Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in… CWE-409
- CVE-2026-116175 vLLM from 0.19.0 before 0.24.0 contains a decompression bomb vulnerability because the… CWE-409
- CVE-2026-115638 OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results… CWE-409