HAPI FHIR (8.10.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/hapi-fhir-8.10.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 22 Oct 2026 23:52:41 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgHAPI FHIR: Cross-tenant partition override and authorization bypasses (CVE-2026-113873, CVE-2026-113874, CVE-2026-113875, CVE-2026-113876)https://feed.craftedsignal.io/briefs/2026-10-hapi-fhir-vulnerabilities/Thu, 22 Oct 2026 23:52:41 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-hapi-fhir-vulnerabilities/Multiple vulnerabilities in HAPI FHIR version 8.10.0 allow for cross-tenant partition override, authorization bypasses, and heap exhaustion via gzip compression, potentially exposing patient data in multi-tenant environments.Four vulnerabilities (CVE-2026-113873, CVE-2026-113874, CVE-2026-113875, CVE-2026-113876) have been identified in HAPI FHIR version 8.10.0, an open-source Java implementation of the HL7 FHIR standard. These vulnerabilities allow an authenticated user to override tenant partitions, bypass authorization controls, or induce heap exhaustion through crafted gzip payloads. The flaws enable unauthorized read or write access to data residing in partitions belonging to other tenants.

Impact

Successful exploitation allows unauthorized cross-tenant data access, leading to a compromise of data isolation. An attacker with legitimate access to one tenant could potentially read or manipulate records within another tenant partition.

Recommendation

  • Inventory all internal and external-facing instances of HAPI FHIR to identify deployments running version 8.10.0.
  • Prioritize patching or updating HAPI FHIR instances to the secure version provided by the upstream maintainers as soon as it becomes available.
  • Review access logs for abnormal cross-partition requests if HAPI FHIR multi-tenancy is in active use.
  • Restrict access to FHIR API endpoints and implement robust input validation and rate limiting to mitigate potential DoS vectors such as heap exhaustion.
]]>highadvisorywebservervulnerabilityfhirjava