Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-10-08T12:55:12 dcmtk: dcmtk: Denial of Service via deeply nested DICOM JSON document 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CWE-770

Uncontrolled mutual recursion between DcmJSONReader::parseDataSet(), DcmJSONReader::parseElement() and DcmJSONReader::parseSequence() in dcmdata/libsrc/dcjsonrd.cc of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaustion and process crash) via a crafted DICOM JSON document with deeply nested sequence (SQ) values. The json2dcm tool and any service that converts untrusted DICOM JSON (for example, DICOMweb payloads) with this reader are affected. The issue is fixed in commit cf955e64c35a1e07ba10698f639d5dcdec53b9d7.

A flaw was found in dcmtk. An attacker can cause a Denial of Service (DoS) by providing a crafted DICOM (Digital Imaging and Communications in Medicine) JSON document containing deeply nested sequence values. Processing this input triggers uncontrolled recursion in the JSON parser, causing stack memory exhaustion and crashing the application.

This vulnerability is rated as Moderate because triggering the crash requires processing a maliciously constructed DICOM JSON payload, which leads to application termination through exhausted stack memory without impacting data confidentiality or integrity. The dcmtk package is not part of core Red Hat Enterprise Linux and is only shipped via community channels such as EPEL. Exposure is confined to standalone conversion utilities or services that parse external DICOMweb metadata. https://www.cve.org/CVERecord?id=CVE-2026-44037 https://nvd.nist.gov/vuln/detail/CVE-2026-44037 https://github.com/DCMTK/dcmtk/commit/cf955e64c35a1e07ba10698f639d5dcdec53b9d7 https://support.dcmtk.org/redmine/issues/1225