CVE-2026-5440

Received Received - Intake

Memory Exhaustion via Unbounded Content-Length in HTTP Server

Publication date: 2026-04-09

Last updated on: 2026-04-14

Assigner: CERT/CC

Description

A memory exhaustion vulnerability exists in the HTTP server due to unbounded use of the `Content-Length` header. The server allocates memory directly based on the attacker supplied header value without enforcing an upper limit. A crafted HTTP request containing an extremely large `Content-Length` value can trigger excessive memory allocation and server termination, even without sending a request body.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-09

Last Modified

2026-04-14

Generated

2026-07-06

AI Q&A

2026-04-09

EPSS Evaluated

2026-07-05

NVD

CVE-2026-5440

EUVD

EUVD-2026-20917

Affected Vendors & Products

Vendor	Product	Version / Range
orthanc-server	orthanc	to 1.12.11 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Impact Analysis

This vulnerability can lead to denial of service by causing the server to consume excessive memory and terminate unexpectedly.

An attacker can exploit this by sending a request with a very large Content-Length header, which may disrupt normal server operations and availability.

Executive Summary

This vulnerability is a memory exhaustion issue in an HTTP server caused by the unbounded use of the Content-Length header.

The server allocates memory based directly on the value provided in the Content-Length header without enforcing any upper limit.

An attacker can send a crafted HTTP request with an extremely large Content-Length value, which causes the server to allocate excessive memory and potentially terminate, even if the request body is not sent.

Hi! I’m here to help you understand CVE-2026-5440. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70