CVE-2026-5440: Memory Exhaustion via Unbounded Content-Length
A memory exhaustion vulnerability exists in the HTTP server due to unbounded use of the Content-Length header. The server allocates memory directly based on the attacker supplied header value without enforcing an upper limit. A crafted HTTP request containing an extremely large Content-Length value can trigger excessive memory allocation and server termination, even without sending a request body.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-5440?
CVE-2026-5440 has a high severity rating of 7.5 based on the CVSS 3.1 scoring system.
What causes the vulnerability identified as CVE-2026-5440?
CVE-2026-5440 is caused by a memory exhaustion issue in the HTTP server due to the unbounded use of the Content-Length header.
How do I fix CVE-2026-5440?
To fix CVE-2026-5440, you should implement an upper limit on the Content-Length header in your HTTP server configuration.
Which software is affected by CVE-2026-5440?
CVE-2026-5440 affects the Orthanc-server software.
What are the potential effects of exploiting CVE-2026-5440?
Exploiting CVE-2026-5440 may lead to memory exhaustion, causing the server to become unresponsive.