CVE-2026-44031 (GCVE-0-2026-44031)
Vulnerability from cvelistv5
Published
2026-10-08 12:55
Modified
2026-10-08 14:10
Severity ?
8.7 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE
Summary
Uncontrolled recursion in DcmSequenceOfItems::read() and DcmItem::read() in the dcmdata library of OFFIS DCMTK 3.7.0 allows a remote, unauthenticated attacker to cause a denial of service (stack exhaustion and process crash) via a DICOM dataset containing deeply nested sequences (SQ elements). The dataset can be sent in a C-STORE request to storescp, dcmrecv, dcmqrscp, or any other DICOM service built on DCMTK, because the received dataset is parsed before any authentication takes place. Local tools such as dcmdump also crash when opening such a file. The issue is fixed in commit 885ff0f10372bd589b5f44cea974f28a3964cb0f, which adds a configurable sequence nesting depth limit (default 64).
References
Impacted products
Vendor Product Version
OFFIS DCMTK Version: 3.7.0
    cpe:2.3:a:offis:dcmtk:3.7.0:*:*:*:*:*:*:*
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-44031",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-08T14:10:27.354529Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-08T14:10:35.420Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/DCMTK/dcmtk",
          "cpes": [
            "cpe:2.3:a:offis:dcmtk:3.7.0:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "modules": [
            "dcmdata",
            "dcmnet"
          ],
          "product": "DCMTK",
          "programFiles": [
            "dcmdata/libsrc/dcsequen.cc",
            "dcmdata/libsrc/dcitem.cc"
          ],
          "repo": "https://github.com/DCMTK/dcmtk",
          "vendor": "OFFIS",
          "versions": [
            {
              "status": "affected",
              "version": "3.7.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Arjun Basnet from Securin"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Uncontrolled recursion in DcmSequenceOfItems::read() and DcmItem::read() in the dcmdata library of OFFIS DCMTK 3.7.0 allows a remote, unauthenticated attacker to cause a denial of service (stack exhaustion and process crash) via a DICOM dataset containing deeply nested sequences (SQ elements). The dataset can be sent in a C-STORE request to storescp, dcmrecv, dcmqrscp, or any other DICOM service built on DCMTK, because the received dataset is parsed before any authentication takes place. Local tools such as dcmdump also crash when opening such a file. The issue is fixed in commit 885ff0f10372bd589b5f44cea974f28a3964cb0f, which adds a configurable sequence nesting depth limit (default 64)."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "CWE-674 Uncontrolled Recursion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-08T12:55:01.712Z",
        "orgId": "33c584b5-0579-4c06-b2a0-8d8329fcab9c",
        "shortName": "securin"
      },
      "references": [
        {
          "name": "DCMTK issue #1191",
          "tags": [
            "issue-tracking",
            "vendor-advisory"
          ],
          "url": "https://support.dcmtk.org/redmine/issues/1191"
        },
        {
          "name": "Fix commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/DCMTK/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Update to a DCMTK version that contains commit 885ff0f10372bd589b5f44cea974f28a3964cb0f. As of the publication date, no tagged release after DCMTK 3.7.0 includes this fix, so apply the commit or build from the current master branch."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2026-05-25T00:00:00.000Z",
          "value": "CVE ID shared with the vendor"
        },
        {
          "lang": "en",
          "time": "2026-04-04T00:00:00.000Z",
          "value": "Fix committed by the vendor"
        },
        {
          "lang": "en",
          "time": "2026-06-19T00:00:00.000Z",
          "value": "Vendor approved publication"
        }
      ],
      "title": "Uncontrolled recursion in the DCMTK DICOM dataset parser allows unauthenticated remote denial of service"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "33c584b5-0579-4c06-b2a0-8d8329fcab9c",
    "assignerShortName": "securin",
    "cveId": "CVE-2026-44031",
    "datePublished": "2026-10-08T12:55:01.712Z",
    "dateReserved": "2026-05-05T02:49:00.666Z",
    "dateUpdated": "2026-10-08T14:10:35.420Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-44031\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-08T14:10:27.354529Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-08T14:10:32.349Z\"}}], \"cna\": {\"title\": \"Uncontrolled recursion in the DCMTK DICOM dataset parser allows unauthenticated remote denial of service\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Arjun Basnet from Securin\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 8.7, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:offis:dcmtk:3.7.0:*:*:*:*:*:*:*\"], \"repo\": \"https://github.com/DCMTK/dcmtk\", \"vendor\": \"OFFIS\", \"modules\": [\"dcmdata\", \"dcmnet\"], \"product\": \"DCMTK\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.7.0\"}], \"programFiles\": [\"dcmdata/libsrc/dcsequen.cc\", \"dcmdata/libsrc/dcitem.cc\"], \"collectionURL\": \"https://github.com/DCMTK/dcmtk\", \"defaultStatus\": \"unknown\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-05-25T00:00:00.000Z\", \"value\": \"CVE ID shared with the vendor\"}, {\"lang\": \"en\", \"time\": \"2026-04-04T00:00:00.000Z\", \"value\": \"Fix committed by the vendor\"}, {\"lang\": \"en\", \"time\": \"2026-06-19T00:00:00.000Z\", \"value\": \"Vendor approved publication\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Update to a DCMTK version that contains commit 885ff0f10372bd589b5f44cea974f28a3964cb0f. As of the publication date, no tagged release after DCMTK 3.7.0 includes this fix, so apply the commit or build from the current master branch.\"}], \"references\": [{\"url\": \"https://support.dcmtk.org/redmine/issues/1191\", \"name\": \"DCMTK issue #1191\", \"tags\": [\"issue-tracking\", \"vendor-advisory\"]}, {\"url\": \"https://github.com/DCMTK/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f\", \"name\": \"Fix commit\", \"tags\": [\"patch\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Uncontrolled recursion in DcmSequenceOfItems::read() and DcmItem::read() in the dcmdata library of OFFIS DCMTK 3.7.0 allows a remote, unauthenticated attacker to cause a denial of service (stack exhaustion and process crash) via a DICOM dataset containing deeply nested sequences (SQ elements). The dataset can be sent in a C-STORE request to storescp, dcmrecv, dcmqrscp, or any other DICOM service built on DCMTK, because the received dataset is parsed before any authentication takes place. Local tools such as dcmdump also crash when opening such a file. The issue is fixed in commit 885ff0f10372bd589b5f44cea974f28a3964cb0f, which adds a configurable sequence nesting depth limit (default 64).\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-674\", \"description\": \"CWE-674 Uncontrolled Recursion\"}]}], \"providerMetadata\": {\"orgId\": \"33c584b5-0579-4c06-b2a0-8d8329fcab9c\", \"shortName\": \"securin\", \"dateUpdated\": \"2026-10-08T12:55:01.712Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-44031\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-08T14:10:35.420Z\", \"dateReserved\": \"2026-05-05T02:49:00.666Z\", \"assignerOrgId\": \"33c584b5-0579-4c06-b2a0-8d8329fcab9c\", \"datePublished\": \"2026-10-08T12:55:01.712Z\", \"assignerShortName\": \"securin\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.