Source: dcmtk Version: 3.7.0+really3.7.0-7 X-Debbugs-CC: [email protected] Severity: important Tags: security upstream Forwarded: https://support.dcmtk.org/redmine/issues/1191
Hi, The following vulnerability was published for dcmtk. CVE-2026-44031[0]: | Uncontrolled recursion in DcmSequenceOfItems::read() and | DcmItem::read() in the dcmdata library of OFFIS DCMTK 3.7.0 allows a | remote, unauthenticated attacker to cause a denial of service (stack | exhaustion and process crash) via a DICOM dataset containing deeply | nested sequences (SQ elements). The dataset can be sent in a C-STORE | request to storescp, dcmrecv, dcmqrscp, or any other DICOM service | built on DCMTK, because the received dataset is parsed before any | authentication takes place. Local tools such as dcmdump also crash | when opening such a file. The issue is fixed in commit | 885ff0f10372bd589b5f44cea974f28a3964cb0f, which adds a configurable | sequence nesting depth limit (default 64). If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-44031 https://www.cve.org/CVERecord?id=CVE-2026-44031 [1] https://support.dcmtk.org/redmine/issues/1191 [2] https://github.com/DCMTK/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f Please adjust the affected versions in the BTS as needed. Regards, Salvatore
