CVE-2026-44037
Received Received - Intake

Uncontrolled Recursion in DCMTK DICOM JSON Parser

Publication date: 2026-10-08

Last updated on: 2026-10-08

Assigner: securin

Description
Uncontrolled mutual recursion between DcmJSONReader::parseDataSet(), DcmJSONReader::parseElement() and DcmJSONReader::parseSequence() in dcmdata/libsrc/dcjsonrd.cc of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaustion and process crash) via a crafted DICOM JSON document with deeply nested sequence (SQ) values. The json2dcm tool and any service that converts untrusted DICOM JSON (for example, DICOMweb payloads) with this reader are affected. The issue is fixed in commit cf955e64c35a1e07ba10698f639d5dcdec53b9d7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-08
Last Modified
2026-10-08
Generated
2026-10-08
AI Q&A
2026-10-08
EPSS Evaluated
N/A
NVD
CVE-2026-44037
EUVD
EUVD-2026-94940

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
OFFIS DCMTK 3.7.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-674 The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a stack overflow issue in the DCMTK library's JSON parser caused by uncontrolled mutual recursion between three functions: DcmJSONReader::parseDataSet(), DcmJSONReader::parseElement(), and DcmJSONReader::parseSequence(). When processing a crafted DICOM JSON document with deeply nested sequence values, the program exhausts the stack and crashes.

Detection Guidance

Monitor for crashes in applications using DCMTK's json2dcm tool or services processing DICOM JSON. Check for stack overflow errors in logs when processing JSON files with deeply nested sequences.

Impact Analysis

This vulnerability can cause denial of service by crashing applications that process untrusted DICOM JSON data. Services using the json2dcm tool or converting DICOMweb payloads with this reader are affected. An attacker could exploit this by sending a maliciously crafted JSON file to trigger a process crash.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it is a denial-of-service issue in a DICOM JSON parser. However, if exploited, it could disrupt services handling untrusted DICOM JSON, potentially impacting availability of systems processing medical data, which may indirectly affect compliance with availability requirements in these regulations.

Mitigation Strategies

Update DCMTK to a version containing the fix (commit cf955e64c35a1e07ba10698f639d5dcdec53b9d7). If immediate update is not possible, restrict processing of untrusted DICOM JSON files or implement input validation to limit sequence nesting depth.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-44037. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart