CVE-2026-44037 in DCMTK
Summary
by MITRE • 10/08/2026
Uncontrolled mutual recursion between DcmJSONReader::parseDataSet(), DcmJSONReader::parseElement() and DcmJSONReader::parseSequence() in dcmdata/libsrc/dcjsonrd.cc of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaustion and process crash) via a crafted DICOM JSON document with deeply nested sequence (SQ) values. The json2dcm tool and any service that converts untrusted DICOM JSON (for example, DICOMweb payloads) with this reader are affected. The issue is fixed in commit cf955e64c35a1e07ba10698f639d5dcdec53b9d7.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/08/2026
The vulnerability identified involves an uncontrolled mutual recursion within the OFFIS DCMTK library, specifically affecting the DcmJSONReader component in versions prior to 3.7.0. This flaw resides in the source file dcjsonrd.cc and impacts three core parsing functions: parseDataSet, parseElement, and parseSequence. These methods are designed to interpret DICOM data encoded in JSON format, a common requirement for interoperability with modern web-based medical imaging standards such as DICOMweb. The architecture of these parsers relies on recursive calls to handle the hierarchical nature of DICOM objects, where elements can contain other elements or sequences of items. However, the implementation lacks sufficient depth limits or validation checks before initiating further recursive parsing operations. This architectural oversight creates a critical security gap that allows for stack exhaustion when processing maliciously crafted input.
An attacker can exploit this vulnerability by constructing a DICOM JSON document featuring deeply nested sequence values. In standard DICOM terminology, sequences are data structures used to group related elements together and can themselves contain other sequences or items. By artificially inflating the nesting depth of these SQ (Sequence) fields beyond reasonable bounds, an adversary forces the parser into an infinite or excessively deep recursive loop. Each recursive call consumes stack space within the application process. Since there is no mechanism to detect or abort this recursion based on depth thresholds, the system's memory allocation for the execution stack is rapidly depleted. This leads directly to a denial of service condition characterized by stack exhaustion and subsequent process crash. The impact is particularly severe because it does not require code execution privileges; merely submitting a malformed JSON payload through an affected interface is sufficient to disrupt availability.
The operational scope of this vulnerability extends beyond just the standalone json2dcm conversion tool mentioned in initial reports. It affects any service or application that utilizes the DCMTK library to parse untrusted DICOM JSON data. This includes web services implementing the DICOMweb standard, which frequently receive JSON-formatted representations of medical images and associated metadata from various clients. If such a service processes incoming payloads without adequate sanitization or depth limiting before passing them to the DcmJSONReader, it becomes susceptible to remote denial-of-service attacks. The stability of healthcare IT infrastructure relies heavily on the robustness of these parsing components, as crashes in core services can lead to significant disruptions in clinical workflows and data accessibility for medical professionals.
From a classification perspective, this vulnerability aligns with CWE-675, which denotes operations with duplicate or excessive input, specifically regarding uncontrolled recursion depth. It also relates to CWE-400, concerning uncontrolled resource consumption, as the primary consequence is the exhaustion of system resources (stack memory). In terms of offensive security frameworks, this exploit technique maps to MITRE ATT&CK T1496, Resource Hijacking, where an attacker consumes computational resources to degrade service availability. The lack of input validation regarding structural complexity allows for a straightforward exploitation path that targets the reliability rather than the confidentiality or integrity of the system.
Mitigation strategies must focus on both immediate patching and long-term architectural improvements. The primary remediation is to upgrade the DCMTK library to version 3.7.0 or later, where commit cf955e64c35a1e07ba10698f639d5dcdec53b9d7 addresses this issue by implementing proper recursion limits. For systems that cannot immediately upgrade, defensive coding practices should be adopted within the application layer. This includes imposing strict depth limits on JSON parsing operations and validating the structural complexity of incoming DICOM JSON payloads before they are processed by the library. Additionally, deploying web application firewalls or API gateways with rules to detect excessively deep nesting in JSON structures can provide an additional layer of defense against such exploitation attempts. Regular security audits of third-party libraries used for medical data processing are essential to maintain resilience against these types of resource exhaustion attacks.