CVE-2026-113873, CVE-2026-113874, CVE-2026-113875, CVE-2026-113876: HAPI FHIR cross-tenant partition override, authorization bypasses and gzip heap exhaustion

Posted by Abhinav Agarwal on Oct 22 CISA has published four CVE records and CSAF advisory VA-26-294-01 for vulnerabilities in HAPI FHIR, an open-source Java implementation of HL7 FHIR. They were coordinated under VINCE case VU#394579. I reproduced all four on upstream HAPI FHIR 8.10.0, commit 96ac50f89455, using synthetic data. The worst case is that a caller authorized for one tenant can read another tenant's data, or create data in another tenant's partition.

Published 23-Oct-2026 01:28 UTC · First seen 23-Oct-2026 01:27 UTC

Sources

• Open Source Security · 22-Oct-2026