{"vulnerability": "cve-2026-8187", "sightings": [{"uuid": "1dbabcff-c7a7-427e-8673-d5f1afffe40d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8187", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mlgj4jqtbz2k", "content": "CVE-2026-8187 - Open5GS UPF gtp-path.c _gtpv1_u_recv_cb resource consumption\nCVE ID : CVE-2026-8187\n \n Published : May 9, 2026, 11:16 a.m. | 3\u00a0hours, 10\u00a0minutes ago\n \n Description : A flaw has been found in Open5GS up to 2.7.7. This impacts the function _gtpv1_u_recv_cb of the...", "creation_timestamp": "2026-05-09T15:00:09.578085Z"}, {"uuid": "c52bfd00-1a53-4651-bfe8-fae7a504aa18", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-81876", "type": "published-proof-of-concept", "source": "https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-gq9c-wmrm-5hvr", "content": "", "creation_timestamp": "2026-09-17T22:35:19.341081Z"}, {"uuid": "0dee29c5-7f77-4210-ba73-02e16420a3a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-81875", "type": "published-proof-of-concept", "source": "https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-3w98-rrpr-fprr", "content": "", "creation_timestamp": "2026-09-17T22:35:21.222383Z"}, {"uuid": "6afe74eb-a652-40c8-a689-da246ee24f46", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-81871", "type": "published-proof-of-concept", "source": "https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-w34q-cm8f-9c5x", "content": "", "creation_timestamp": "2026-09-17T22:35:22.763697Z"}, {"uuid": "3dca48b1-43ca-418e-a849-943bd8f99042", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-81870", "type": "published-proof-of-concept", "source": "https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg", "content": "", "creation_timestamp": "2026-09-17T22:35:24.669594Z"}, {"uuid": "ebd1ee87-904a-4a38-af61-4f61a4c9f91c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-81876", "type": "seen", "source": "https://gist.github.com/alon710/ccdbb258ac65bfe162fcd19f3dfec9e5", "content": "# CVE-2026-81876: CVE-2026-81876: Unauthenticated Denial of Service via Infinite Loop in HAPI FHIR SHCParser\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-09-17\n> **Full Report:** https://cvereports.com/reports/CVE-2026-81876\n\n## Summary\nCVE-2026-81876 is a high-severity Denial of Service vulnerability in HAPI FHIR, a complete Java implementation of the HL7 FHIR standard. The vulnerability stems from improper usage of Java's java.util.zip.Inflater class within the Smart Health Card (SHC) parser.\n\n## TL;DR\nAn unauthenticated remote attacker can trigger an infinite loop in the JVM by submitting a malformed JSON Web Token representing a Smart Health Card. This loop pins the worker thread at 100% CPU, leading to potential complete application Denial of Service.\n\n## Technical Details\n\n- **CWE ID**: CWE-835 / CWE-400\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 7.5 (High)\n- **EPSS Score**: 0.0063\n- **Impact**: Denial of Service (DoS)\n- **Exploit Status**: Theoretical / Unproven\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- HAPI FHIR core library (org.hl7.fhir.core)\n- **org.hl7.fhir.core**: < 6.9.12 (Fixed in: `6.9.12`)\n\n## Mitigation\n\n- Upgrade HAPI FHIR core to version 6.9.12 or newer.\n- Configure Web Application Firewall (WAF) rules to detect and drop payloads containing DEFLATE headers in JWS structures.\n- Restrict input stream size to mitigate decompression bomb risks.\n\n**Remediation Steps:**\n1. Identify dependencies on 'org.hl7.fhir.core' and related 'org.hl7.fhir.r5' modules within build configurations.\n2. Update the dependency version to 6.9.12.\n3. Rebuild and execute automated tests to verify standard FHIR processing functionality remains intact.\n4. Deploy the updated application artifact to staging and production environments.\n\n## References\n\n- [GitHub Security Advisory GHSA-gq9c-wmrm-5hvr](https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-gq9c-wmrm-5hvr)\n- [Fix Commit d804558b](https://github.com/hapifhir/org.hl7.fhir.core/commit/d804558bd77372b1629e55a5b901cad3f5134cdc)\n- [Fix Commit edd5d8c1](https://github.com/hapifhir/org.hl7.fhir.core/commit/edd5d8c139e669e39270785f08be7b63aefef24c)\n- [Fix Pull Request #2493](https://github.com/hapifhir/org.hl7.fhir.core/pull/2493)\n- [NVD Vulnerability Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-81876)\n- [CVE Authority Record](https://www.cve.org/CVERecord?id=CVE-2026-81876)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-81876) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-18T10:32:02.368986Z"}, {"uuid": "da9156d9-6145-4bc8-857c-6ab59132a737", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-81875", "type": "seen", "source": "https://gist.github.com/alon710/839e5670d8770ce9ac0c8d550d9e25b4", "content": "# CVE-2026-81875: CVE-2026-81875: Unbounded DEFLATE Decompression Denial of Service in HAPI FHIR SHCParser\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-09-17\n> **Full Report:** https://cvereports.com/reports/CVE-2026-81875\n\n## Summary\nA critical denial of service vulnerability exists in the HAPI FHIR SHCParser within the org.hl7.fhir.core Java library. Unbounded decompression of raw DEFLATE data during Smart Health Card parsing allows unauthenticated remote attackers to trigger JVM heap exhaustion and crash the application.\n\n## TL;DR\nUnbounded DEFLATE decompression in HAPI FHIR SHCParser allows remote attackers to cause JVM OutOfMemory crashes via malformed Smart Health Card payloads.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-409 (Improper Handling of Highly Compressed Data)\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1**: 7.5 (High)\n- **EPSS Score**: 0.0063 (Percentile: 48.59%)\n- **Impact**: Denial of Service (DoS) via JVM Heap Exhaustion\n- **Exploit Status**: Proof of Concept (PoC) Available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Applications running Java with the HAPI FHIR core libraries (org.hl7.fhir.core) parsing Smart Health Cards (SHC).\n- Vaccination validation portals and clinical verification services that process health card JWTs.\n- **org.hl7.fhir.core**: < 6.9.12 (Fixed in: `6.9.12`)\n\n## Mitigation\n\n- Upgrade HAPI FHIR dependencies to version 6.9.12 or later.\n- Implement request size filtering and JWT validation in API Gateways.\n- Configure Web Application Firewall rules to block JWT payloads using DEFLATE compression if not explicitly required.\n- Set explicit JVM constraints to restart the server automatically on OutOfMemoryError.\n\n**Remediation Steps:**\n1. Identify all projects and microservices using HAPI FHIR core (org.hl7.fhir.core).\n2. Update the dependency version in pom.xml or build.gradle to 6.9.12.\n3. Rebuild the application and execute integration tests using the provided PoC structure to verify successful protection.\n4. Deploy the updated applications and configure container orchestrators to handle JVM crashes safely during transition periods.\n\n## References\n\n- [GitHub Security Advisory GHSA-3w98-rrpr-fprr](https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-3w98-rrpr-fprr)\n- [NVD CVE-2026-81875 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-81875)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-81875) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-18T11:31:11.772871Z"}, {"uuid": "379de0c0-439e-469f-bcb0-b41d5e6b29d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-81870", "type": "seen", "source": "https://bsky.app/profile/gcpweekly.bsky.social/post/3mwd2n5ayqy2l", "content": "CVE-2026-81870 CVE-2026-81871 CVE-2026-84303 CVE-2026-84304 CVE-2026-84445 GHSA-hrxh-6v49-42gf N/A Security fixes for apigee-operators. This addresses the following vulnerabilities: CVE-2026-33818 CVE-2026-39821 CVE-2026-56853 CVE-2026-56858 CVE-2026-56859 CVE-2026-56860", "creation_timestamp": "2026-09-25T05:40:14.948566Z"}, {"uuid": "06564164-f5d7-4e24-b086-cdfeaa1cc55e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-81871", "type": "seen", "source": "https://bsky.app/profile/gcpweekly.bsky.social/post/3mwd2n5ayqy2l", "content": "CVE-2026-81870 CVE-2026-81871 CVE-2026-84303 CVE-2026-84304 CVE-2026-84445 GHSA-hrxh-6v49-42gf N/A Security fixes for apigee-operators. This addresses the following vulnerabilities: CVE-2026-33818 CVE-2026-39821 CVE-2026-56853 CVE-2026-56858 CVE-2026-56859 CVE-2026-56860", "creation_timestamp": "2026-09-25T05:40:14.977124Z"}, {"uuid": "4b18179b-c04b-4473-acd9-2a855b2a28e4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-81870", "type": "seen", "source": "https://bsky.app/profile/gcpweekly.bsky.social/post/3mwd2n5tfgv2c", "content": "CVE-2026-56860 CVE-2026-56862 CVE-2026-56864 CVE-2026-56865 CVE-2026-81870 CVE-2026-84303 CVE-2026-84304 CVE-2026-84445 GHSA-hrxh-6v49-42gf N/A Security fixes for apigee-redis. This addresses the following vulnerabilities: CVE-2026-33818 CVE-2026-39821 CVE-2026-46600", "creation_timestamp": "2026-09-25T05:40:17.707718Z"}, {"uuid": "2c7a795b-b912-4d2c-94c4-2d15f18d77fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-81872", "type": "seen", "source": "https://gist.github.com/alon710/6253be53c4d49b5dcba96435919c97c0", "content": "# CVE-2026-81872: CVE-2026-81872: CPU Exhaustion via Tight Loop in OpenTelemetry-Go BatchingProcessor\n\n> **CVSS Score:** 6.3\n> **Published:** 2026-09-29\n> **Full Report:** https://cvereports.com/reports/CVE-2026-81872\n\n## Summary\nAn uncontrolled resource consumption vulnerability in the logs SDK of OpenTelemetry-Go allows remote attackers to trigger a denial of service. Under conditions of downstream exporter backpressure, the BatchingProcessor enters a tight loop, exhausting CPU resources. This occurs because the processor immediately schedules retry attempts without waiting for its ticker interval, spinning continuously when the internal queue remains filled above the batch size. The issue affects all versions prior to v0.21.0 of the go.opentelemetry.io/otel/sdk/log package.\n\n## TL;DR\nA high-severity CPU exhaustion vulnerability in OpenTelemetry-Go's logging SDK allows remote attackers to cause a denial of service via tight-loop execution when downstream exporters experience backpressure.\n\n## Technical Details\n\n- **CWE ID**: CWE-400 (Uncontrolled Resource Consumption), CWE-834 (Excessive Iteration)\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 6.3 (Medium)\n- **EPSS Score**: 0.00524 (Percentile: 42.16%)\n- **Impact**: Denial of Service / CPU Exhaustion\n- **Exploit Status**: No weaponized exploits exist in the wild\n- **KEV Status**: Not listed in CISA KEV\n\n## Affected Systems\n\n- Applications running Go services utilizing the OpenTelemetry-Go SDK logs package (go.opentelemetry.io/otel/sdk/log)\n- **go.opentelemetry.io/otel/sdk/log**: < v0.21.0 (Fixed in: `v0.21.0`)\n\n## Mitigation\n\n- Upgrade OpenTelemetry-Go logs SDK to version v0.21.0 or higher\n- Implement strict timeout limits on logging exporters to prevent prolonged backpressure\n- Establish CPU usage alerts on logging microservices to detect abnormal spikes\n\n**Remediation Steps:**\n1. Identify vulnerable dependencies within the Go module files using scanning tools\n2. Update the go.mod dependency: go get go.opentelemetry.io/otel/sdk/log@v0.21.0\n3. Run go mod tidy to clean up dependency configurations\n4. Recompile the application and redeploy to production environments\n\n## References\n\n- [Official CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-81872)\n- [NVD Entry](https://nvd.nist.gov/vuln/detail/CVE-2026-81872)\n- [GitHub Security Advisory](https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65)\n- [GitHub Official Pull Request](https://github.com/open-telemetry/opentelemetry-go/pull/8620)\n- [Official Fix Commit](https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582)\n- [Issue Tracker Discussion](https://github.com/open-telemetry/opentelemetry-go/issues/6797)\n- [Vulnerable Component Release Tag](https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0)\n- [Wiz Vulnerability Database](https://www.wiz.io/vulnerability-database/cve/cve-2026-81872)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-81872) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-29T18:30:31.000000Z"}, {"uuid": "d768aff7-a540-443b-889b-716ff0de6fac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-81872", "type": "published-proof-of-concept", "source": "https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65", "content": "", "creation_timestamp": "2026-09-02T12:25:33.000000Z"}, {"uuid": "820e61c0-ca21-4bcb-9c1e-6825b97d9067", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-81870", "type": "seen", "source": "https://bsky.app/profile/gcpweekly.bsky.social/post/3mwtmes37q32m", "content": "CVE-2026-56865 N/A Security fixes for apigee-prometheus-adapter. This addresses the following vulnerability: CVE-2026-81870 N/A Security fixes for apigee-runtime. This addresses the following vulnerabilities: CVE-2026-13506 CVE-2026-49844 CVE-2026-50645 CVE-2026-8763 N/A", "creation_timestamp": "2026-10-01T19:40:17.853222Z"}, {"uuid": "b922cb86-823b-42c0-a43d-92b6d5ba2e69", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-81870", "type": "seen", "source": "https://bsky.app/profile/gcpweekly.bsky.social/post/3mwtmesawdi2w", "content": "Security fixes for apigee-synchronizer. This addresses the following vulnerabilities: CVE-2026-13506 CVE-2026-49844 CVE-2026-50645 CVE-2026-8763 N/A Security fixes for apigee-watcher. This addresses the following vulnerability: CVE-2026-81870", "creation_timestamp": "2026-10-01T19:40:18.620645Z"}]}