CVE-2026-105279: J4Care dcm4che Missing Authentication for Critical Function
In the default configuration, the archive accepts DICOM associations from an unregistered calling AE. A remote peer can use C-FIND and C-GET to enumerate and retrieve patient information and medical images. It can also use C-STORE to file fabricated study content under an existing patient identity.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
J4Care dcm4cheto a version that resolves this vulnerability.Fixed in 5.35.2
Event History
Frequently Asked Questions
Who can exploit this issue?
Any remote peer that can establish a DICOM association with the archive can exploit it; no registered calling AE or authentication is required in the default configuration.
What can an unauthenticated peer do?
An attacker can use C-FIND and C-GET to enumerate and retrieve patient information and medical images. They can also use C-STORE to add fabricated study content under an existing patient identity.
Are default deployments affected?
Yes. The described behavior occurs in the default configuration, where the archive accepts DICOM associations from an unregistered calling AE.