HAPI FHIR Package Vulnerability: Denial of Service Risk
- Severity
- HIGH
- Affected component
- hapi-fhir (maven)
- Patched version
- Not yet available
An early warning has been issued for a high-severity vulnerability in the HAPI FHIR package. The vulnerability, which is under investigation, may cause denial of service due to unbounded DEFLATE decompression in SHCParser.java.
What happened
An early warning has been issued regarding a critical vulnerability in the HAPI FHIR package. The vulnerability is tracked under GHSA-3W98-RRPR-FPRR and is associated with the SHCParser.java component. The issue arises from the unbounded DEFLATE decompression of Smart Health Card JWT payloads, which can lead to a denial of service. This vulnerability has not been exploited in the wild as of the latest reports. The exact version range of the affected HAPI FHIR package has not been authoritatively published yet.
Professional software engineers using the HAPI FHIR package should assess their exposure by reviewing their current dependencies and usage of the package. It is crucial to monitor the primary sources for updates on the vulnerability and any forthcoming patches.
What to do about it
- Monitor the primary sources for updates on the vulnerability and any forthcoming patches.
- If an official fix is published, upgrade to a version of HAPI FHIR that includes the fix for this vulnerability.
- In the absence of an official fix, consider implementing additional checks or limits on the decompression process as a temporary measure.
- Review and test your application's resilience to denial of service attacks.
- Stay informed about updates from the HAPI FHIR project and related security advisories.
How 0Day would have caught this
hapi-fhir is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If your project depends on the HAPI FHIR package, you may be affected. The exact version range of the affected package has not been published yet, so it is advisable to monitor the primary sources for updates.
What should I do right now?
Monitor the primary sources for updates on the vulnerability and any forthcoming patches. If an official fix is published, upgrade to the patched version of HAPI FHIR.
Is there an official fix available yet?
No official fix has been published yet. Continue to monitor the primary sources for updates.