{"vulnerability": "CVE-2026-8187", "sightings": [{"uuid": "1dbabcff-c7a7-427e-8673-d5f1afffe40d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8187", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mlgj4jqtbz2k", "content": "CVE-2026-8187 - Open5GS UPF gtp-path.c _gtpv1_u_recv_cb resource consumption\nCVE ID : CVE-2026-8187\n \n Published : May 9, 2026, 11:16 a.m. | 3\u00a0hours, 10\u00a0minutes ago\n \n Description : A flaw has been found in Open5GS up to 2.7.7. This impacts the function _gtpv1_u_recv_cb of the...", "creation_timestamp": "2026-05-09T15:00:09.578085Z"}, {"uuid": "c52bfd00-1a53-4651-bfe8-fae7a504aa18", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-81876", "type": "published-proof-of-concept", "source": "https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-gq9c-wmrm-5hvr", "content": "", "creation_timestamp": "2026-09-17T22:35:19.341081Z"}, {"uuid": "0dee29c5-7f77-4210-ba73-02e16420a3a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-81875", "type": "published-proof-of-concept", "source": "https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-3w98-rrpr-fprr", "content": "", "creation_timestamp": "2026-09-17T22:35:21.222383Z"}, {"uuid": "6afe74eb-a652-40c8-a689-da246ee24f46", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-81871", "type": "published-proof-of-concept", "source": "https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-w34q-cm8f-9c5x", "content": "", "creation_timestamp": "2026-09-17T22:35:22.763697Z"}, {"uuid": "3dca48b1-43ca-418e-a849-943bd8f99042", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-81870", "type": "published-proof-of-concept", "source": "https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg", "content": "", "creation_timestamp": "2026-09-17T22:35:24.669594Z"}, {"uuid": "ebd1ee87-904a-4a38-af61-4f61a4c9f91c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-81876", "type": "seen", "source": "https://gist.github.com/alon710/ccdbb258ac65bfe162fcd19f3dfec9e5", "content": "# CVE-2026-81876: CVE-2026-81876: Unauthenticated Denial of Service via Infinite Loop in HAPI FHIR SHCParser\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-09-17\n> **Full Report:** https://cvereports.com/reports/CVE-2026-81876\n\n## Summary\nCVE-2026-81876 is a high-severity Denial of Service vulnerability in HAPI FHIR, a complete Java implementation of the HL7 FHIR standard. The vulnerability stems from improper usage of Java's java.util.zip.Inflater class within the Smart Health Card (SHC) parser.\n\n## TL;DR\nAn unauthenticated remote attacker can trigger an infinite loop in the JVM by submitting a malformed JSON Web Token representing a Smart Health Card. This loop pins the worker thread at 100% CPU, leading to potential complete application Denial of Service.\n\n## Technical Details\n\n- **CWE ID**: CWE-835 / CWE-400\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 7.5 (High)\n- **EPSS Score**: 0.0063\n- **Impact**: Denial of Service (DoS)\n- **Exploit Status**: Theoretical / Unproven\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- HAPI FHIR core library (org.hl7.fhir.core)\n- **org.hl7.fhir.core**: < 6.9.12 (Fixed in: `6.9.12`)\n\n## Mitigation\n\n- Upgrade HAPI FHIR core to version 6.9.12 or newer.\n- Configure Web Application Firewall (WAF) rules to detect and drop payloads containing DEFLATE headers in JWS structures.\n- Restrict input stream size to mitigate decompression bomb risks.\n\n**Remediation Steps:**\n1. Identify dependencies on 'org.hl7.fhir.core' and related 'org.hl7.fhir.r5' modules within build configurations.\n2. Update the dependency version to 6.9.12.\n3. Rebuild and execute automated tests to verify standard FHIR processing functionality remains intact.\n4. Deploy the updated application artifact to staging and production environments.\n\n## References\n\n- [GitHub Security Advisory GHSA-gq9c-wmrm-5hvr](https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-gq9c-wmrm-5hvr)\n- [Fix Commit d804558b](https://github.com/hapifhir/org.hl7.fhir.core/commit/d804558bd77372b1629e55a5b901cad3f5134cdc)\n- [Fix Commit edd5d8c1](https://github.com/hapifhir/org.hl7.fhir.core/commit/edd5d8c139e669e39270785f08be7b63aefef24c)\n- [Fix Pull Request #2493](https://github.com/hapifhir/org.hl7.fhir.core/pull/2493)\n- [NVD Vulnerability Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-81876)\n- [CVE Authority Record](https://www.cve.org/CVERecord?id=CVE-2026-81876)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-81876) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-18T10:32:02.368986Z"}, {"uuid": "da9156d9-6145-4bc8-857c-6ab59132a737", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-81875", "type": "seen", "source": "https://gist.github.com/alon710/839e5670d8770ce9ac0c8d550d9e25b4", "content": "# CVE-2026-81875: CVE-2026-81875: Unbounded DEFLATE Decompression Denial of Service in HAPI FHIR SHCParser\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-09-17\n> **Full Report:** https://cvereports.com/reports/CVE-2026-81875\n\n## Summary\nA critical denial of service vulnerability exists in the HAPI FHIR SHCParser within the org.hl7.fhir.core Java library. Unbounded decompression of raw DEFLATE data during Smart Health Card parsing allows unauthenticated remote attackers to trigger JVM heap exhaustion and crash the application.\n\n## TL;DR\nUnbounded DEFLATE decompression in HAPI FHIR SHCParser allows remote attackers to cause JVM OutOfMemory crashes via malformed Smart Health Card payloads.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-409 (Improper Handling of Highly Compressed Data)\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1**: 7.5 (High)\n- **EPSS Score**: 0.0063 (Percentile: 48.59%)\n- **Impact**: Denial of Service (DoS) via JVM Heap Exhaustion\n- **Exploit Status**: Proof of Concept (PoC) Available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Applications running Java with the HAPI FHIR core libraries (org.hl7.fhir.core) parsing Smart Health Cards (SHC).\n- Vaccination validation portals and clinical verification services that process health card JWTs.\n- **org.hl7.fhir.core**: < 6.9.12 (Fixed in: `6.9.12`)\n\n## Mitigation\n\n- Upgrade HAPI FHIR dependencies to version 6.9.12 or later.\n- Implement request size filtering and JWT validation in API Gateways.\n- Configure Web Application Firewall rules to block JWT payloads using DEFLATE compression if not explicitly required.\n- Set explicit JVM constraints to restart the server automatically on OutOfMemoryError.\n\n**Remediation Steps:**\n1. Identify all projects and microservices using HAPI FHIR core (org.hl7.fhir.core).\n2. Update the dependency version in pom.xml or build.gradle to 6.9.12.\n3. Rebuild the application and execute integration tests using the provided PoC structure to verify successful protection.\n4. Deploy the updated applications and configure container orchestrators to handle JVM crashes safely during transition periods.\n\n## References\n\n- [GitHub Security Advisory GHSA-3w98-rrpr-fprr](https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-3w98-rrpr-fprr)\n- [NVD CVE-2026-81875 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-81875)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-81875) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-18T11:31:11.772871Z"}]}