Source: dcmtk Version: 3.7.0+really3.7.0-7 X-Debbugs-CC: [email protected] Severity: important Tags: security upstream Forwarded: https://support.dcmtk.org/redmine/issues/1214
Hi, The following vulnerability was published for dcmtk. CVE-2026-44033[0]: | Uncontrolled recursion in XMLNode::ParseXMLElement() and | XMLNode::emptyTheNode() in the bundled XML parser | (ofstd/libsrc/ofxml.cc) of OFFIS DCMTK 3.7.0 allows an attacker to | cause a denial of service (stack exhaustion and process crash) via a | crafted XML document with deeply nested elements. The parser is | reachable through dcmencap when encapsulating a CDA document, and | through any application that calls OFXMLParser::parseFile() or | OFXMLParser::parseString() on untrusted input. The issue is fixed in | commit d12e350e687530eb41e2b0c860aff4d8c04e5941. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-44033 https://www.cve.org/CVERecord?id=CVE-2026-44033 [1] https://support.dcmtk.org/redmine/issues/1214 [2] https://github.com/DCMTK/dcmtk/commit/d12e350e687530eb41e2b0c860aff4d8c04e5941 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
