CVE-2026-44037

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-44037", "assignerOrgId": "33c584b5-0579-4c06-b2a0-8d8329fcab9c", "state": "PUBLISHED", "assignerShortName": "securin", "dateReserved": "2026-05-05T02:49:00.667Z", "datePublished": "2026-10-08T12:55:12.628Z", "dateUpdated": "2026-10-08T14:08:38.661Z"}, "containers": {"cna": {"title": "Uncontrolled recursion in DCMTK JSON reader allows denial of service", "descriptions": [{"lang": "en", "value": "Uncontrolled mutual recursion between DcmJSONReader::parseDataSet(), DcmJSONReader::parseElement() and DcmJSONReader::parseSequence() in dcmdata/libsrc/dcjsonrd.cc of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaustion and process crash) via a crafted DICOM JSON document with deeply nested sequence (SQ) values. The json2dcm tool and any service that converts untrusted DICOM JSON (for example, DICOMweb payloads) with this reader are affected. The issue is fixed in commit cf955e64c35a1e07ba10698f639d5dcdec53b9d7."}], "affected": [{"vendor": "OFFIS", "product": "DCMTK", "collectionURL": "https://github.com/DCMTK/dcmtk", "repo": "https://github.com/DCMTK/dcmtk", "modules": ["dcmdata"], "programFiles": ["dcmdata/libsrc/dcjsonrd.cc"], "cpes": ["cpe:2.3:a:offis:dcmtk:3.7.0:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "3.7.0", "status": "affected"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-674", "description": "CWE-674 Uncontrolled Recursion"}]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "baseScore": 6.8, "baseSeverity": "MEDIUM"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM"}}], "solutions": [{"lang": "en", "value": "Update to a DCMTK version that contains commit cf955e64c35a1e07ba10698f639d5dcdec53b9d7. As of the publication date, no tagged release after DCMTK 3.7.0 includes this fix, so apply the commit or build from the current master branch."}], "references": [{"url": "https://support.dcmtk.org/redmine/issues/1225", "name": "DCMTK issue #1225", "tags": ["issue-tracking", "vendor-advisory"]}, {"url": "https://github.com/DCMTK/dcmtk/commit/cf955e64c35a1e07ba10698f639d5dcdec53b9d7", "name": "Fix commit", "tags": ["patch"]}], "credits": [{"lang": "en", "value": "Arjun Basnet from Securin", "type": "finder"}], "timeline": [{"time": "2026-05-25T00:00:00.000Z", "lang": "en", "value": "CVE ID shared with the vendor"}, {"time": "2026-06-17T00:00:00.000Z", "lang": "en", "value": "Fix committed by the vendor"}, {"time": "2026-06-19T00:00:00.000Z", "lang": "en", "value": "Vendor approved publication"}], "source": {"discovery": "EXTERNAL"}, "providerMetadata": {"orgId": "33c584b5-0579-4c06-b2a0-8d8329fcab9c", "shortName": "securin", "dateUpdated": "2026-10-08T12:55:12.628Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-08T14:08:30.608062Z", "id": "CVE-2026-44037", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-08T14:08:38.661Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-44037", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-08T14:08:30.608062Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-08T14:08:34.739Z"}}], "cna": {"title": "Uncontrolled recursion in DCMTK JSON reader allows denial of service", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Arjun Basnet from Securin"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 6.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 5.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:offis:dcmtk:3.7.0:*:*:*:*:*:*:*"], "repo": "https://github.com/DCMTK/dcmtk", "vendor": "OFFIS", "modules": ["dcmdata"], "product": "DCMTK", "versions": [{"status": "affected", "version": "3.7.0"}], "programFiles": ["dcmdata/libsrc/dcjsonrd.cc"], "collectionURL": "https://github.com/DCMTK/dcmtk", "defaultStatus": "unknown"}], "timeline": [{"lang": "en", "time": "2026-05-25T00:00:00.000Z", "value": "CVE ID shared with the vendor"}, {"lang": "en", "time": "2026-06-17T00:00:00.000Z", "value": "Fix committed by the vendor"}, {"lang": "en", "time": "2026-06-19T00:00:00.000Z", "value": "Vendor approved publication"}], "solutions": [{"lang": "en", "value": "Update to a DCMTK version that contains commit cf955e64c35a1e07ba10698f639d5dcdec53b9d7. As of the publication date, no tagged release after DCMTK 3.7.0 includes this fix, so apply the commit or build from the current master branch."}], "references": [{"url": "https://support.dcmtk.org/redmine/issues/1225", "name": "DCMTK issue #1225", "tags": ["issue-tracking", "vendor-advisory"]}, {"url": "https://github.com/DCMTK/dcmtk/commit/cf955e64c35a1e07ba10698f639d5dcdec53b9d7", "name": "Fix commit", "tags": ["patch"]}], "descriptions": [{"lang": "en", "value": "Uncontrolled mutual recursion between DcmJSONReader::parseDataSet(), DcmJSONReader::parseElement() and DcmJSONReader::parseSequence() in dcmdata/libsrc/dcjsonrd.cc of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaustion and process crash) via a crafted DICOM JSON document with deeply nested sequence (SQ) values. The json2dcm tool and any service that converts untrusted DICOM JSON (for example, DICOMweb payloads) with this reader are affected. The issue is fixed in commit cf955e64c35a1e07ba10698f639d5dcdec53b9d7."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-674", "description": "CWE-674 Uncontrolled Recursion"}]}], "providerMetadata": {"orgId": "33c584b5-0579-4c06-b2a0-8d8329fcab9c", "shortName": "securin", "dateUpdated": "2026-10-08T12:55:12.628Z"}}}, "cveMetadata": {"cveId": "CVE-2026-44037", "state": "PUBLISHED", "dateUpdated": "2026-10-08T14:08:38.661Z", "dateReserved": "2026-05-05T02:49:00.667Z", "assignerOrgId": "33c584b5-0579-4c06-b2a0-8d8329fcab9c", "datePublished": "2026-10-08T12:55:12.628Z", "assignerShortName": "securin"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://github.com/DCMTK/dcmtk", "cpes": ["cpe:2.3:a:offis:dcmtk:3.7.0:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "modules": ["dcmdata"], "product": "DCMTK", "programFiles": ["dcmdata/libsrc/dcjsonrd.cc"], "repo": "https://github.com/DCMTK/dcmtk", "vendor": "OFFIS", "versions": [{"status": "affected", "version": "3.7.0"}]}], "source": "33c584b5-0579-4c06-b2a0-8d8329fcab9c"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Uncontrolled mutual recursion between DcmJSONReader::parseDataSet(), DcmJSONReader::parseElement() and DcmJSONReader::parseSequence() in dcmdata/libsrc/dcjsonrd.cc of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaustion and process crash) via a crafted DICOM JSON document with deeply nested sequence (SQ) values. The json2dcm tool and any service that converts untrusted DICOM JSON (for example, DICOMweb payloads) with this reader are affected. The issue is fixed in commit cf955e64c35a1e07ba10698f639d5dcdec53b9d7."}], "id": "CVE-2026-44037", "lastModified": "2026-10-08T21:10:00.133", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "33c584b5-0579-4c06-b2a0-8d8329fcab9c", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "33c584b5-0579-4c06-b2a0-8d8329fcab9c", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44037", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-08T14:08:30.608062Z", "version": "2.0.3"}}]}, "published": "2026-10-08T13:17:17.817", "references": [{"source": "33c584b5-0579-4c06-b2a0-8d8329fcab9c", "url": "https://github.com/DCMTK/dcmtk/commit/cf955e64c35a1e07ba10698f639d5dcdec53b9d7"}, {"source": "33c584b5-0579-4c06-b2a0-8d8329fcab9c", "url": "https://support.dcmtk.org/redmine/issues/1225"}], "sourceIdentifier": "33c584b5-0579-4c06-b2a0-8d8329fcab9c", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-674"}], "source": "33c584b5-0579-4c06-b2a0-8d8329fcab9c", "type": "Secondary"}]}

{"bugzilla": {"description": "dcmtk: dcmtk: Denial of Service via deeply nested DICOM JSON document", "id": "2547949", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2547949"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-770", "details": ["A flaw was found in dcmtk. An attacker can cause a Denial of Service (DoS) by providing a crafted DICOM (Digital Imaging and Communications in Medicine) JSON document containing deeply nested sequence values. Processing this input triggers uncontrolled recursion in the JSON parser, causing stack memory exhaustion and crashing the application."], "name": "CVE-2026-44037", "public_date": "2026-10-08T12:55:12Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-44037\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-44037\nhttps://github.com/DCMTK/dcmtk/commit/cf955e64c35a1e07ba10698f639d5dcdec53b9d7\nhttps://support.dcmtk.org/redmine/issues/1225"], "statement": "This vulnerability is rated as Moderate because triggering the crash requires processing a maliciously constructed DICOM JSON payload, which leads to application termination through exhausted stack memory without impacting data confidentiality or integrity. The dcmtk package is not part of core Red Hat Enterprise Linux and is only shipped via community channels such as EPEL. Exposure is confined to standalone conversion utilities or services that parse external DICOMweb metadata.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.7.0"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "DCMTK", "source": "cna", "vendor": "OFFIS"}, "product": "dcmtk", "vendor": "offis"}], "created": "2026-10-08T15:15:11.630135+00:00", "updated": "2026-10-09T03:15:15.734783+00:00", "vendors": ["offis", "offis$PRODUCT$dcmtk"]}