Common Weakness Enumeration
CWE-835
AllowedLoop with Unreachable Exit Condition ('Infinite Loop')
Abstraction: Base · Status: Incomplete
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
1314 vulnerabilities reference this CWE, most recent first.
GHSA-GH88-3PXP-6FM8
Vulnerability from github – Published: 2022-01-21 23:39 – Updated: 2022-01-21 21:04
VLAI
Summary
Infinite Loop in colors.js
Details
The package colors after 1.4.0 are vulnerable to Denial of Service (DoS) that was introduced through an infinite loop in the americanFlag module. Unfortunately this appears to have been a purposeful attempt by a maintainer of colors to make the package unusable, other maintainers' controls over this package appear to have been revoked in an attempt to prevent them from fixing the issue. Vulnerable Code js for (let i = 666; i < Infinity; i++;) { Alternative Remediation Suggested * Pin dependancy to 1.4.0
Severity
7.5 (High)
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "colors"
},
"ranges": [
{
"events": [
{
"introduced": "1.4.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-23567"
],
"database_specific": {
"cwe_ids": [
"CWE-835"
],
"github_reviewed": true,
"github_reviewed_at": "2022-01-21T21:04:45Z",
"nvd_published_at": "2022-01-14T20:15:00Z",
"severity": "HIGH"
},
"details": "The package colors after 1.4.0 are vulnerable to Denial of Service (DoS) that was introduced through an infinite loop in the americanFlag module. Unfortunately this appears to have been a purposeful attempt by a maintainer of colors to make the package unusable, other maintainers\u0027 controls over this package appear to have been revoked in an attempt to prevent them from fixing the issue. Vulnerable Code js for (let i = 666; i \u003c Infinity; i++;) { Alternative Remediation Suggested * Pin dependancy to 1.4.0",
"id": "GHSA-gh88-3pxp-6fm8",
"modified": "2022-01-21T21:04:45Z",
"published": "2022-01-21T23:39:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23567"
},
{
"type": "WEB",
"url": "https://github.com/Marak/colors.js/issues/285"
},
{
"type": "WEB",
"url": "https://github.com/Marak/colors.js/issues/285%23issuecomment-1008212640"
},
{
"type": "WEB",
"url": "https://github.com/Marak/colors.js/commit/074a0f8ed0c31c35d13d28632bd8a049ff136fb6%23diff-92bbac9a308cd5fcf9db165841f2d90ce981baddcb2b1e26cfff170929af3bd1R18"
},
{
"type": "PACKAGE",
"url": "https://github.com/Marak/colors.js"
},
{
"type": "WEB",
"url": "https://snyk.io/blog/open-source-maintainer-pulls-the-plug-on-npm-packages-colors-and-faker-now-what"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JS-COLORS-2331906"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Infinite Loop in colors.js"
}
GHSA-GH8J-2PGF-X458
Vulnerability from github – Published: 2021-09-13 20:05 – Updated: 2024-10-26 18:35
VLAI
Summary
Infinite Loop in rencode
Details
The rencode package through 1.0.6 for Python allows an infinite loop in typecode decoding (such as via ;\x2f\x7f), enabling a remote attack that consumes CPU and memory.
Severity
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "rencode"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.0.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-40839"
],
"database_specific": {
"cwe_ids": [
"CWE-835"
],
"github_reviewed": true,
"github_reviewed_at": "2021-09-13T19:11:37Z",
"nvd_published_at": "2021-09-10T02:15:00Z",
"severity": "HIGH"
},
"details": "The rencode package through 1.0.6 for Python allows an infinite loop in typecode decoding (such as via ;\\x2f\\x7f), enabling a remote attack that consumes CPU and memory.",
"id": "GHSA-gh8j-2pgf-x458",
"modified": "2024-10-26T18:35:18Z",
"published": "2021-09-13T20:05:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-40839"
},
{
"type": "WEB",
"url": "https://github.com/aresch/rencode/pull/29"
},
{
"type": "WEB",
"url": "https://github.com/aresch/rencode/commit/572ff74586d9b1daab904c6f7f7009ce0143bb75"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-gh8j-2pgf-x458"
},
{
"type": "PACKAGE",
"url": "https://github.com/aresch/rencode"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/rencode/PYSEC-2021-345.yaml"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BMVQRPDVSVZNGGX57CFKCYT3DEYO4QB6"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MCLETLGVM5DBX6QNHQFW6TWGO5T3DENY"
},
{
"type": "WEB",
"url": "https://pypi.org/project/rencode/#history"
},
{
"type": "WEB",
"url": "https://seclists.org/fulldisclosure/2021/Sep/16"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20211008-0001"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Infinite Loop in rencode"
}
GHSA-GHP6-Q6JG-FC8Q
Vulnerability from github – Published: 2022-05-13 01:43 – Updated: 2022-05-13 01:43
VLAI
Details
In GNU Libextractor 1.4, there is an integer signedness error for the chunk size in the EXTRACTOR_nsfe_extract_method function in plugins/nsfe_extractor.c, leading to an infinite loop for a crafted size.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2017-15602"
],
"database_specific": {
"cwe_ids": [
"CWE-835"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-10-18T21:29:00Z",
"severity": "HIGH"
},
"details": "In GNU Libextractor 1.4, there is an integer signedness error for the chunk size in the EXTRACTOR_nsfe_extract_method function in plugins/nsfe_extractor.c, leading to an infinite loop for a crafted size.",
"id": "GHSA-ghp6-q6jg-fc8q",
"modified": "2022-05-13T01:43:48Z",
"published": "2022-05-13T01:43:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-15602"
},
{
"type": "WEB",
"url": "https://ftp.gnu.org/gnu/libextractor/libextractor-1.6.tar.gz"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2017/12/msg00000.html"
},
{
"type": "WEB",
"url": "http://lists.gnu.org/archive/html/bug-libextractor/2017-10/msg00005.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-GHVX-46W7-4V7R
Vulnerability from github – Published: 2022-05-13 01:42 – Updated: 2022-05-13 01:42
VLAI
Details
ccn-lite-ccnb2xml in CCN-lite before 2.0.0 allows context-dependent attackers to have unspecified impact via a crafted file, which triggers infinite recursion and a stack overflow.
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2017-12412"
],
"database_specific": {
"cwe_ids": [
"CWE-835"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-02-07T17:29:00Z",
"severity": "HIGH"
},
"details": "ccn-lite-ccnb2xml in CCN-lite before 2.0.0 allows context-dependent attackers to have unspecified impact via a crafted file, which triggers infinite recursion and a stack overflow.",
"id": "GHSA-ghvx-46w7-4v7r",
"modified": "2022-05-13T01:42:40Z",
"published": "2022-05-13T01:42:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-12412"
},
{
"type": "WEB",
"url": "https://github.com/cn-uofbasel/ccn-lite/issues/128"
},
{
"type": "WEB",
"url": "https://github.com/cn-uofbasel/ccn-lite/releases/tag/2.0.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-GJ7R-55X2-8VV5
Vulnerability from github – Published: 2022-09-10 00:00 – Updated: 2022-09-16 00:00
VLAI
Details
PDF Labs pdftk-java v3.2.3 was discovered to contain an infinite loop via the component /text/pdf/PdfReader.java.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2021-37819"
],
"database_specific": {
"cwe_ids": [
"CWE-835"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-09-09T22:15:00Z",
"severity": "HIGH"
},
"details": "PDF Labs pdftk-java v3.2.3 was discovered to contain an infinite loop via the component /text/pdf/PdfReader.java.",
"id": "GHSA-gj7r-55x2-8vv5",
"modified": "2022-09-16T00:00:40Z",
"published": "2022-09-10T00:00:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37819"
},
{
"type": "WEB",
"url": "https://gitlab.com/pdftk-java/pdftk/-/merge_requests/21/diffs?commit_id=9b0cbb76c8434a8505f02ada02a94263dcae9247#diff-content-b3cfd29983c793bcae2375502abd5baa8f5d1081"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-GJ9G-P4V8-HQFC
Vulnerability from github – Published: 2022-05-13 01:49 – Updated: 2022-05-13 01:49
VLAI
Details
GNU Libextractor before 1.7 contains an infinite loop vulnerability in EXTRACTOR_mpeg_extract_method (mpeg_extractor.c).
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2018-14347"
],
"database_specific": {
"cwe_ids": [
"CWE-835"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-07-17T15:29:00Z",
"severity": "MODERATE"
},
"details": "GNU Libextractor before 1.7 contains an infinite loop vulnerability in EXTRACTOR_mpeg_extract_method (mpeg_extractor.c).",
"id": "GHSA-gj9g-p4v8-hqfc",
"modified": "2022-05-13T01:49:56Z",
"published": "2022-05-13T01:49:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14347"
},
{
"type": "WEB",
"url": "https://gnunet.org/bugs/view.php?id=5399"
},
{
"type": "WEB",
"url": "https://gnunet.org/git/libextractor.git/commit/?id=f033468cd36e2b8bf92d747fbd683b2ace8da394"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2018/08/msg00025.html"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2018/dsa-4290"
},
{
"type": "WEB",
"url": "http://lists.gnu.org/archive/html/bug-libextractor/2018-07/msg00000.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-GM2P-WF5C-W3PJ
Vulnerability from github – Published: 2025-04-21 16:19 – Updated: 2025-10-14 21:59
VLAI
Summary
Infinite loop condition in Amazon.IonDotnet
Details
Summary
Amazon.IonDotnet (ion-dotnet) is a .NET library with an implementation of the Ion data serialization format.
An issue exists in Amazon.IonDotnet and the RawBinaryReader class where, under certain conditions, an actor could trigger an infinite loop condition.
Impact
When reading binary Ion data through Amazon.IonDotnet using the RawBinaryReader class, Amazon.IonDotnet does not check the number of bytes read from the underlying stream while deserializing the binary format. If the Ion data is malformed or truncated, this triggers an infinite loop condition that could potentially result in a denial of service.
Impacted versions: <=1.3.0
Patches
This issue has been addressed in Amazon.IonDotnet version 1.3.1. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.
Workarounds
There are no workarounds. Upgrade to version 1.3.1.
References
If you have any questions or comments about this advisory, contact AWS/Amazon Security via our vulnerability reporting page or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue.
Credit
We would like to thank Josh Coleman from Symbotic for collaborating on this issue through the coordinated vulnerability disclosure process.
Severity
{
"affected": [
{
"package": {
"ecosystem": "NuGet",
"name": "Amazon.IonDotnet"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.3.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-3857"
],
"database_specific": {
"cwe_ids": [
"CWE-502",
"CWE-835"
],
"github_reviewed": true,
"github_reviewed_at": "2025-04-21T16:19:20Z",
"nvd_published_at": "2025-04-21T16:15:54Z",
"severity": "HIGH"
},
"details": "## Summary\n\n[Amazon.IonDotnet (ion-dotnet)](https://github.com/amazon-ion/ion-dotnet) is a .NET library with an implementation of the [Ion data serialization format](https://amazon-ion.github.io/ion-docs/).\n\nAn issue exists in Amazon.IonDotnet and the RawBinaryReader class where, under certain conditions, an actor could trigger an infinite loop condition.\n\n## Impact\n\nWhen reading binary Ion data through Amazon.IonDotnet using the RawBinaryReader class, Amazon.IonDotnet does not check the number of bytes read from the underlying stream while deserializing the binary format. If the Ion data is malformed or truncated, this triggers an infinite loop condition that could potentially result in a denial of service.\n\n**Impacted versions: \u003c=1.3.0**\n\n## Patches\n\nThis issue has been addressed in Amazon.IonDotnet version [1.3.1](https://github.com/amazon-ion/ion-dotnet/releases/tag/v1.3.1). We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\n## Workarounds\n\nThere are no workarounds. Upgrade to version 1.3.1.\n\n## References\n\nIf you have any questions or comments about this advisory, contact AWS/Amazon Security via our [vulnerability reporting page](https://aws.amazon.com/security/vulnerability-reporting) or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.\n\n## Credit\n\nWe would like to thank Josh Coleman from Symbotic for collaborating on this issue through the coordinated vulnerability disclosure process.",
"id": "GHSA-gm2p-wf5c-w3pj",
"modified": "2025-10-14T21:59:16Z",
"published": "2025-04-21T16:19:20Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/amazon-ion/ion-dotnet/security/advisories/GHSA-gm2p-wf5c-w3pj"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3857"
},
{
"type": "WEB",
"url": "https://github.com/amazon-ion/ion-dotnet/commit/34a4f5215eceac1bb7bf434c4f2310d64d1b703b"
},
{
"type": "WEB",
"url": "https://aws.amazon.com/security/security-bulletins/AWS-2025-009"
},
{
"type": "PACKAGE",
"url": "https://github.com/amazon-ion/ion-dotnet"
},
{
"type": "WEB",
"url": "https://github.com/amazon-ion/ion-dotnet/releases/tag/v1.3.1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
],
"summary": "Infinite loop condition in Amazon.IonDotnet"
}
GHSA-GMVF-RV8W-2HRH
Vulnerability from github – Published: 2024-09-04 15:30 – Updated: 2024-09-04 18:30
VLAI
Details
HAProxy 2.9.x before 2.9.10, 3.0.x before 3.0.4, and 3.1.x through 3.1-dev6 allows a remote denial of service.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2024-45506"
],
"database_specific": {
"cwe_ids": [
"CWE-835"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-04T15:15:14Z",
"severity": "HIGH"
},
"details": "HAProxy 2.9.x before 2.9.10, 3.0.x before 3.0.4, and 3.1.x through 3.1-dev6 allows a remote denial of service.",
"id": "GHSA-gmvf-rv8w-2hrh",
"modified": "2024-09-04T18:30:57Z",
"published": "2024-09-04T15:30:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45506"
},
{
"type": "WEB",
"url": "https://www.haproxy.org"
},
{
"type": "WEB",
"url": "https://www.haproxy.org/download/3.1/src/CHANGELOG"
},
{
"type": "WEB",
"url": "https://www.mail-archive.com/haproxy%40formilux.org/msg45280.html"
},
{
"type": "WEB",
"url": "https://www.mail-archive.com/haproxy%40formilux.org/msg45281.html"
},
{
"type": "WEB",
"url": "http://git.haproxy.org/?p=haproxy-3.0.git%3Ba=commitdiff%3Bh=c725db17e8416ffb3c1537aea756356228ce5e3c"
},
{
"type": "WEB",
"url": "http://git.haproxy.org/?p=haproxy-3.0.git%3Ba=commitdiff%3Bh=d636e515453320c6e122c313c661a8ac7d387c7f"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-GPMQ-FQJH-4PRC
Vulnerability from github – Published: 2022-05-13 01:13 – Updated: 2025-04-20 03:34
VLAI
Details
The sdhci_sdma_transfer_multi_blocks function in hw/sd/sdhci.c in QEMU (aka Quick Emulator) allows local OS guest privileged users to cause a denial of service (infinite loop and QEMU process crash) via vectors involving the transfer mode register during multi block transfer.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2017-5987"
],
"database_specific": {
"cwe_ids": [
"CWE-835"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-03-20T16:59:00Z",
"severity": "MODERATE"
},
"details": "The sdhci_sdma_transfer_multi_blocks function in hw/sd/sdhci.c in QEMU (aka Quick Emulator) allows local OS guest privileged users to cause a denial of service (infinite loop and QEMU process crash) via vectors involving the transfer mode register during multi block transfer.",
"id": "GHSA-gpmq-fqjh-4prc",
"modified": "2025-04-20T03:34:30Z",
"published": "2022-05-13T01:13:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5987"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1421995"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html"
},
{
"type": "WEB",
"url": "https://lists.gnu.org/archive/html/qemu-devel/2017-02/msg02776.html"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201704-01"
},
{
"type": "WEB",
"url": "http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=6e86d90352adf6cb08295255220295cf23c4286e"
},
{
"type": "WEB",
"url": "http://git.qemu-project.org/?p=qemu.git;a=commit;h=6e86d90352adf6cb08295255220295cf23c4286e"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2017/02/14/8"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/96263"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-GQ9C-WMRM-5HVR
Vulnerability from github – Published: 2026-09-17 20:32 – Updated: 2026-09-17 20:32
VLAI
Summary
HAPI FHIR: SHCParser DEFLATE infinite loop causes denial of service
Details
Summary
A malformed Smart Health Card (SHC) JWT with zip: "DEF" and an empty or truncated DEFLATE payload causes SHCParser.inflate() to loop forever. This allows an attacker who can submit SHC content for validation to pin a JVM worker thread indefinitely, causing denial of service.
Details
The vulnerable code is in org.hl7.fhir.r5/src/main/java/org/hl7/fhir/r5/elementmodel/SHCParser.java.
decodeJWT() inflates the JWT payload when the header contains "zip":"DEF":
// SHCParser.java:300-302
if ("DEF".equals(res.header.asString("zip"))) {
payloadJson = inflate(payloadJson);
}
inflate() loops only on !inflater.finished() and does not check inflater.needsInput(), inflater.needsDictionary(), or zero-progress output:
// SHCParser.java:455-468
while (!inflater.finished()) {
final int count = inflater.inflate(buffer);
outputStream.write(buffer, 0, count);
}
For empty or truncated raw DEFLATE input, Inflater.inflate() returns 0, finished() remains false, and needsInput() becomes true, producing an infinite tight loop. The same unsafe loop pattern also exists in decompress() at SHCParser.java:410-423.
The validator reaches this path during SHC validation and during file-format detection for SHC-looking input (ResourceChecker.java:115-118).
PoC
Compile the project, then run a minimal local harness that calls:
SHCParser.inflate(new byte[0]);
This never returns. Local verification:
timeout 3s java -cp ... VerifyDoSFindings shcHang
echo $?
# 124 = timeout killed the hung process
A JWT PoC uses:
- header: Base64URL(
{"zip":"DEF"}) - payload: empty or truncated raw DEFLATE bytes
- signature: arbitrary
Submit the resulting token as SHC content, for example via a .shc file or content beginning with shc:/ that reaches the validator's SHC detection path.
Impact
This is a denial-of-service vulnerability. A single malformed SHC validation request can consume a worker thread indefinitely. In services that validate uploaded SHC content, a small number of concurrent malformed requests can exhaust all validation workers.
Credits
- Thai Son Dinh from VinSOC Labs (R&D)
Severity
7.5 (High)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 6.9.11"
},
"package": {
"ecosystem": "Maven",
"name": "ca.uhn.hapi.fhir:org.hl7.fhir.r5"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.9.12"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 6.9.11"
},
"package": {
"ecosystem": "Maven",
"name": "ca.uhn.hapi.fhir:org.hl7.fhir.validation"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.9.12"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 6.9.11"
},
"package": {
"ecosystem": "Maven",
"name": "ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.9.12"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-81876"
],
"database_specific": {
"cwe_ids": [
"CWE-20",
"CWE-400",
"CWE-835"
],
"github_reviewed": true,
"github_reviewed_at": "2026-09-17T20:32:21Z",
"nvd_published_at": "2026-09-16T19:17:44Z",
"severity": "HIGH"
},
"details": "### Summary\nA malformed Smart Health Card (SHC) JWT with `zip: \"DEF\"` and an empty or truncated DEFLATE payload causes `SHCParser.inflate()` to loop forever. This allows an attacker who can submit SHC content for validation to pin a JVM worker thread indefinitely, causing denial of service.\n\n### Details\nThe vulnerable code is in `org.hl7.fhir.r5/src/main/java/org/hl7/fhir/r5/elementmodel/SHCParser.java`.\n\n`decodeJWT()` inflates the JWT payload when the header contains `\"zip\":\"DEF\"`:\n\n```java\n// SHCParser.java:300-302\nif (\"DEF\".equals(res.header.asString(\"zip\"))) {\n payloadJson = inflate(payloadJson);\n}\n```\n\n`inflate()` loops only on `!inflater.finished()` and does not check `inflater.needsInput()`, `inflater.needsDictionary()`, or zero-progress output:\n\n```java\n// SHCParser.java:455-468\nwhile (!inflater.finished()) {\n final int count = inflater.inflate(buffer);\n outputStream.write(buffer, 0, count);\n}\n```\n\nFor empty or truncated raw DEFLATE input, `Inflater.inflate()` returns `0`, `finished()` remains `false`, and `needsInput()` becomes `true`, producing an infinite tight loop. The same unsafe loop pattern also exists in `decompress()` at `SHCParser.java:410-423`.\n\nThe validator reaches this path during SHC validation and during file-format detection for SHC-looking input (`ResourceChecker.java:115-118`).\n\n### PoC\nCompile the project, then run a minimal local harness that calls:\n\n```java\nSHCParser.inflate(new byte[0]);\n```\n\nThis never returns. Local verification:\n\n```bash\ntimeout 3s java -cp ... VerifyDoSFindings shcHang\necho $?\n# 124 = timeout killed the hung process\n```\n\nA JWT PoC uses:\n\n- header: Base64URL(`{\"zip\":\"DEF\"}`)\n- payload: empty or truncated raw DEFLATE bytes\n- signature: arbitrary\n\nSubmit the resulting token as SHC content, for example via a `.shc` file or content beginning with `shc:/` that reaches the validator\u0027s SHC detection path.\n\n### Impact\nThis is a denial-of-service vulnerability. A single malformed SHC validation request can consume a worker thread indefinitely. In services that validate uploaded SHC content, a small number of concurrent malformed requests can exhaust all validation workers.\n\n### Credits\n- Thai Son Dinh from VinSOC Labs (R\u0026D)",
"id": "GHSA-gq9c-wmrm-5hvr",
"modified": "2026-09-17T20:32:21Z",
"published": "2026-09-17T20:32:21Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-gq9c-wmrm-5hvr"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-81876"
},
{
"type": "WEB",
"url": "https://github.com/hapifhir/org.hl7.fhir.core/pull/2493"
},
{
"type": "WEB",
"url": "https://github.com/hapifhir/org.hl7.fhir.core/commit/d804558bd77372b1629e55a5b901cad3f5134cdc"
},
{
"type": "WEB",
"url": "https://github.com/hapifhir/org.hl7.fhir.core/commit/edd5d8c139e669e39270785f08be7b63aefef24c"
},
{
"type": "PACKAGE",
"url": "https://github.com/hapifhir/org.hl7.fhir.core"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "HAPI FHIR: SHCParser DEFLATE infinite loop causes denial of service"
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.