CVE-2026-5438: Gzip Decompression Bomb via Content-Encoding Header
A gzip decompression bomb vulnerability exists when Orthanc processes HTTP request with Content-Encoding: gzip. The server does not enforce limits on decompressed size and allocates memory based on attacker-controlled compression metadata. A specially crafted gzip payload can trigger excessive memory allocation and exhaust system memory.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-5438?
CVE-2026-5438 has a severity of high, with a CVSS score of 7.5.
What type of vulnerability is CVE-2026-5438?
CVE-2026-5438 is a gzip decompression bomb vulnerability that affects the Orthanc server.
How does the CVE-2026-5438 vulnerability exploit memory allocation?
CVE-2026-5438 exploits memory allocation by not enforcing limits on decompressed sizes, allowing excessive memory usage based on attacker-controlled data.
How can I mitigate CVE-2026-5438?
To mitigate CVE-2026-5438, ensure that your Orthanc server enforces limits on the decompressed size of gzip payloads.
What software is affected by CVE-2026-5438?
CVE-2026-5438 affects the Orthanc server, specifically the Orthanc software.