CVE-2026-5438
Received Received - Intake
Gzip Decompression Bomb in Orthanc Causes Memory Exhaustion

Publication date: 2026-04-09

Last updated on: 2026-04-15

Assigner: CERT/CC

Description
A gzip decompression bomb vulnerability exists when Orthanc processes HTTP request with `Content-Encoding: gzip`. The server does not enforce limits on decompressed size and allocates memory based on attacker-controlled compression metadata. A specially crafted gzip payload can trigger excessive memory allocation and exhaust system memory.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-09
Last Modified
2026-04-15
Generated
2026-06-16
AI Q&A
2026-04-09
EPSS Evaluated
2026-06-14
NVD
CVE-2026-5438
EUVD
EUVD-2026-20914
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
orthanc-server orthanc to 1.12.11 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a gzip decompression bomb issue in Orthanc when it processes HTTP requests with the header 'Content-Encoding: gzip'. The server does not limit the size of the decompressed data and allocates memory based on the compression metadata provided by the attacker. This allows an attacker to craft a malicious gzip payload that causes the server to allocate excessive memory.

Impact Analysis

The impact of this vulnerability is that a specially crafted gzip payload can cause the server to allocate excessive amounts of memory, potentially exhausting system memory. This can lead to denial of service conditions where the server becomes unresponsive or crashes due to lack of available memory.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-5438. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart