Bug 2547947 (CVE-2026-44036) - CVE-2026-44036 dcmtk: dcmtk: Denial of Service via uncontrolled recursion during XML parsing
Summary: CVE-2026-44036 dcmtk: dcmtk: Denial of Service via uncontrolled recursion dur...
Keywords:
Status: NEW
Alias: CVE-2026-44036
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2547996 2547997
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-10-08 13:02 UTC by OSIDB Bzimport
Modified: 2026-10-08 14:34 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-10-08 13:02:48 UTC 
Uncontrolled mutual recursion between DcmXMLParseHelper::parseDataSet() and DcmXMLParseHelper::parseSequence() in the XML-to-DICOM converter (dcmdata/libdcxml/xml2dcm.cc) of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaustion and process crash) via a crafted XML file with deeply nested sequence and item elements. The xml2dcm tool and any service that converts untrusted XML to DICOM with this code are affected. The issue is fixed in commit 87f256d73e30656a822bf7d76d1cf1d9bb693954.
Note You need to log in before you can comment on or make changes to this bug.