CVE-2026-44037: Uncontrolled recursion in DCMTK JSON reader allows denial of service
Uncontrolled mutual recursion between DcmJSONReader::parseDataSet(), DcmJSONReader::parseElement() and DcmJSONReader::parseSequence() in dcmdata/libsrc/dcjsonrd.cc of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaustion and process crash) via a crafted DICOM JSON document with deeply nested sequence (SQ) values. The json2dcm tool and any service that converts untrusted DICOM JSON (for example, DICOMweb payloads) with this reader are affected. The issue is fixed in commit cf955e64c35a1e07ba10698f639d5dcdec53b9d7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OFFIS DCMTKto a version that resolves this vulnerability.Patch cf955e64c35a1e07ba10698f639d5dcdec53b9d7
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service issue?
Deployments using the affected JSON reader to convert untrusted DICOM JSON are exposed. This includes the json2dcm tool and services that accept DICOMweb payloads or other attacker-controlled DICOM JSON.
What must an attacker provide to trigger the crash?
An attacker needs to supply a crafted DICOM JSON document containing deeply nested sequence (SQ) values. Exploitation is local in the supplied severity vector and requires user interaction, but no privileges are required.
What can be done if the fix cannot be applied immediately?
Do not process untrusted DICOM JSON with the affected reader, or restrict inputs to trusted sources. Where possible, reject or limit documents with excessively deep nested SQ values before they reach DCMTK conversion.
How can I determine whether a system has the fix?
The issue is fixed by commit cf955e64c35a1e07ba10698f639d5dcdec53b9d7. Verify whether the DCMTK source or packaged build in use includes that commit or its equivalent fix.