{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/hapi-fhir-8.10.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-113873"},{"cvss":8.1,"id":"CVE-2026-113874"},{"cvss":3.1,"id":"CVE-2026-113875"},{"cvss":4.3,"id":"CVE-2026-113876"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["HAPI FHIR (8.10.0)"],"_cs_severities":["high"],"_cs_tags":["webserver","vulnerability","fhir","java"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eFour vulnerabilities (CVE-2026-113873, CVE-2026-113874, CVE-2026-113875, CVE-2026-113876) have been identified in HAPI FHIR version 8.10.0, an open-source Java implementation of the HL7 FHIR standard. These vulnerabilities allow an authenticated user to override tenant partitions, bypass authorization controls, or induce heap exhaustion through crafted gzip payloads. The flaws enable unauthorized read or write access to data residing in partitions belonging to other tenants.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthorized cross-tenant data access, leading to a compromise of data isolation. An attacker with legitimate access to one tenant could potentially read or manipulate records within another tenant partition.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory all internal and external-facing instances of HAPI FHIR to identify deployments running version 8.10.0.\u003c/li\u003e\n\u003cli\u003ePrioritize patching or updating HAPI FHIR instances to the secure version provided by the upstream maintainers as soon as it becomes available.\u003c/li\u003e\n\u003cli\u003eReview access logs for abnormal cross-partition requests if HAPI FHIR multi-tenancy is in active use.\u003c/li\u003e\n\u003cli\u003eRestrict access to FHIR API endpoints and implement robust input validation and rate limiting to mitigate potential DoS vectors such as heap exhaustion.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-22T23:52:41Z","date_published":"2026-10-22T23:52:41Z","id":"https://feed.craftedsignal.io/briefs/2026-10-hapi-fhir-vulnerabilities/","summary":"Multiple vulnerabilities in HAPI FHIR version 8.10.0 allow for cross-tenant partition override, authorization bypasses, and heap exhaustion via gzip compression, potentially exposing patient data in multi-tenant environments.","title":"HAPI FHIR: Cross-tenant partition override and authorization bypasses (CVE-2026-113873, CVE-2026-113874, CVE-2026-113875, CVE-2026-113876)","url":"https://feed.craftedsignal.io/briefs/2026-10-hapi-fhir-vulnerabilities/"}],"language":"en","title":"CraftedSignal Threat Feed - HAPI FHIR (8.10.0)","version":"https://jsonfeed.org/version/1.1"}