OFFIS DCMTK 3.7.0 JSON Reader dcjsonrd.cc parseSequence recursion

Summaryinfo

A vulnerability has been found in OFFIS DCMTK 3.7.0 and classified as problematic. The affected element is the function DcmJSONReader::parseDataSet/DcmJSONReader::parseElement/DcmJSONReader::parseSequence of the file dcmdata/libsrc/dcjsonrd.cc of the component JSON Reader. The manipulation leads to recursion. This vulnerability is referenced as CVE-2026-44037. Remote exploitation of the attack is possible. No exploit is available. To fix this issue, it is recommended to deploy a patch.

Detailsinfo

A vulnerability was found in OFFIS DCMTK 3.7.0 and classified as problematic. This issue affects the function DcmJSONReader::parseDataSet/DcmJSONReader::parseElement/DcmJSONReader::parseSequence of the file dcmdata/libsrc/dcjsonrd.cc of the component JSON Reader. The manipulation with an unknown input leads to a recursion vulnerability. Using CWE to declare the problem leads to CWE-674. The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack. Impacted is availability. The summary by CVE is:

Uncontrolled mutual recursion between DcmJSONReader::parseDataSet(), DcmJSONReader::parseElement() and DcmJSONReader::parseSequence() in dcmdata/libsrc/dcjsonrd.cc of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaustion and process crash) via a crafted DICOM JSON document with deeply nested sequence (SQ) values. The json2dcm tool and any service that converts untrusted DICOM JSON (for example, DICOMweb payloads) with this reader are affected. The issue is fixed in commit cf955e64c35a1e07ba10698f639d5dcdec53b9d7.

It is possible to read the advisory at support.dcmtk.org. The identification of this vulnerability is CVE-2026-44037 since 05/05/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1499 according to MITRE ATT&CK.

Applying the patch cf955e64c35a1e07ba10698f639d5dcdec53b9d7 is able to eliminate this problem.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• OFFIS

Name

• DCMTK

Version

• 3.7.0

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion