CVE-2026-44037
Description
A flaw was found in dcmtk. An attacker can cause a Denial of Service (DoS) by providing a crafted DICOM (Digital Imaging and Communications in Medicine) JSON document containing deeply nested sequence values. Processing this input triggers uncontrolled recursion in the JSON parser, causing stack memory exhaustion and crashing the application.
Statement
This vulnerability is rated as Moderate because triggering the crash requires processing a maliciously constructed DICOM JSON payload, which leads to application termination through exhausted stack memory without impacting data confidentiality or integrity. The dcmtk package is not part of core Red Hat Enterprise Linux and is only shipped via community channels such as EPEL. Exposure is confined to standalone conversion utilities or services that parse external DICOMweb metadata.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
