Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.3
CVE-2026-50254: DCMTK Toolkit can run out of memory from remote requests
CVE-2026-50254 · published 4 months ago
Summary
The DCMTK toolkit on Debian and Ubuntu can be forced by an unauthenticated attacker to repeatedly open a specially crafted connection, causing it to consume more and more memory. Over time the memory use grows until the service crashes and stops accepting connections until it is manually restarted. Apply the latest package updates or restart the service with a memory‑limiting configuration to prevent this condition.
What to do
- Update debian dcmtk to version 3.7.0+really3.7.0-7.
- Update debian dcmtk to version 3.6.9-5+deb13u3.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:14 | debian | dcmtk |
< 3.7.0+really3.7.0-7 Fix: upgrade to 3.7.0+really3.7.0-7
|
| Debian:11 | debian | dcmtk | All versions |
| Debian:12 | debian | dcmtk | All versions |
| Debian:13 | debian | dcmtk |
< 3.6.9-5+deb13u3 Fix: upgrade to 3.6.9-5+deb13u3
|
| Ubuntu:Pro:16.04:LTS | canonical | dcmtk | All versions |
Original advisory text
OFFIS DCMTK Toolkit Missing Release of Memory after Effective Lifetime
An unauthenticated remote attacker can repeatedly send a single crafted connection request to leak memory. Against storescp in its default single-process mode, memory grows quickly and the service is eventually killed, after which it stops accepting connections until an operator restarts it.
References
- https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-181-01 Vendor Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-50254 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-50254 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-50254 Third Party Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50254... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-50254 Vendor Advisory
- https://github.com/DCMTK/dcmtk/releases/tag/latest URL
- https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-1... URL
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-401Memory Leak
Timeline
Published30 Jun 2026
Updated4 Nov 2026
First seen30 Jun 2026
Sources
CVE-2026-50254 · NVD
DEBIAN-CVE-2026-50254 · OSV
UBUNTU-CVE-2026-50254 · OSV
CVE-2026-50254 · OSV
Track software like this
Free during beta