Bug 2547949 (CVE-2026-44037) - CVE-2026-44037 dcmtk: dcmtk: Denial of Service via deeply nested DICOM JSON document
Summary: CVE-2026-44037 dcmtk: dcmtk: Denial of Service via deeply nested DICOM JSON d...
Keywords:
Status: NEW
Alias: CVE-2026-44037
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2548021 2548024
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-10-08 13:04 UTC by OSIDB Bzimport
Modified: 2026-10-08 15:38 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-10-08 13:04:26 UTC 
Uncontrolled mutual recursion between DcmJSONReader::parseDataSet(), DcmJSONReader::parseElement() and DcmJSONReader::parseSequence() in dcmdata/libsrc/dcjsonrd.cc of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaustion and process crash) via a crafted DICOM JSON document with deeply nested sequence (SQ) values. The json2dcm tool and any service that converts untrusted DICOM JSON (for example, DICOMweb payloads) with this reader are affected. The issue is fixed in commit cf955e64c35a1e07ba10698f639d5dcdec53b9d7.
Note You need to log in before you can comment on or make changes to this bug.