HAPI FHIR versions before 6.9.12 contain an improper input validation vulnerability (CWE-20) in the SHCParser component when processing Smart Health Card JWTs. Specifically, if the JWT header contains zip: "DEF" and the raw-DEFLATE payload is empty or truncated, the SHCParser.decodeJWT() method enters an infinite loop during decompression. This occurs because Inflater.inflate() returns zero progress while Inflater.finished() is false and Inflater.needsInput() is true, and the loop lacks a termination check for Inflater.needsDictionary(). The same zero-progress pattern exists in SHCParser.decompress(), and ResourceChecker.java can trigger SHC parsing during file-format detection. The vulnerability can cause a denial of service by pinning JVM worker threads indefinitely and exhausting all validation workers under concurrent requests. The issue is addressed and fixed in version 6.9.12.

This vulnerability results in a denial of service (DoS) condition by causing infinite loops that pin JVM worker threads indefinitely. Under concurrent exploitation, all validation worker threads can be exhausted, potentially disrupting healthcare interoperability services relying on HAPI FHIR. There is no impact on confidentiality or integrity reported.

Upgrade HAPI FHIR to version 6.9.12 or later, where this issue is fixed. No other mitigations are indicated or necessary as the fix addresses the root cause in the SHCParser component.