Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-44037: DCMTK may crash on deeply nested DICOM JSON

CVE-2026-44037 · published 27 days ago

Summary

The DCMTK library version 3.7.0, including the json2dcm conversion tool and any service that reads DICOM data in JSON format, can run out of memory and stop working if it processes a specially crafted JSON file with many nested levels. This can be used to make the application stop responding. Updating DCMTK to a version that includes the provided fix eliminates the risk.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	offis	dcmtk	3.7.0
Debian:12	debian	dcmtk	All versions
Ubuntu:Pro:16.04:LTS	canonical	dcmtk	All versions

Original advisory text

Uncontrolled recursion in DCMTK JSON reader allows denial of service

Uncontrolled mutual recursion between DcmJSONReader::parseDataSet(), DcmJSONReader::parseElement() and DcmJSONReader::parseSequence() in dcmdata/libsrc/dcjsonrd.cc of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaustion and process crash) via a crafted DICOM JSON document with deeply nested sequence (SQ) values. The json2dcm tool and any service that converts untrusted DICOM JSON (for example, DICOMweb payloads) with this reader are affected. The issue is fixed in commit cf955e64c35a1e07ba10698f639d5dcdec53b9d7.

References

https://github.com/DCMTK/dcmtk/commit/cf955e64c35a1e07ba10698f639d5dcdec53b9d7 Third Party Advisory
https://support.dcmtk.org/redmine/issues/1225 Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2026-44037 Vendor Advisory
https://ubuntu.com/security/CVE-2026-44037 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-44037 Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

7.3 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-674Uncontrolled Recursion

Timeline

Published8 Oct 2026

Updated21 Oct 2026

First seen8 Oct 2026

Sources

CVE-2026-44037 · NVD

CVE-2026-44037 · MITRE

DEBIAN-CVE-2026-44037 · OSV

UBUNTU-CVE-2026-44037 · OSV

CVE-2026-44037 · OSV

Track software like this

Free during beta