CVE-2026-44031

Uncontrolled recursion in DcmSequenceOfItems::read() and DcmItem::read() in the dcmdata library of OFFIS DCMTK 3.7.0 allows a remote, unauthenticated attacker to cause a denial of service (stack exhaustion and process crash) via a DICOM dataset containing deeply nested sequences (SQ elements). The dataset can be sent in a C-STORE request to storescp, dcmrecv, dcmqrscp, or any other DICOM service built on DCMTK, because the received dataset is parsed before any authentication takes place. Local tools such as dcmdump also crash when opening such a file. The issue is fixed in commit 885ff0f10372bd589b5f44cea974f28a3964cb0f, which adds a configurable sequence nesting depth limit (default 64).

• CWE-674

• https://github.com/DCMTK/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f
• https://support.dcmtk.org/redmine/issues/1191

Published

Oct 8, 2026

Last Modified

Oct 8, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-44022Docling simplifies document processing by parsing diverse fo…5.5
• CVE-2026-44023Docling Core defines core data types and transformations for…8.6
• CVE-2026-44024Fluentd collects events from various data sources and writes…9.8
• CVE-2026-44025Fluentd collects events from various data sources and writes…7.5
• CVE-2026-44028An issue was discovered in Nix before 2.34.7 and Lix before …7.5
• CVE-2026-44029An issue was discovered in Nix before 2.34.7. Writing to arb…5.3
• CVE-2026-44033Uncontrolled recursion in XMLNode::ParseXMLElement() and XML…5.5
• CVE-2026-44034A heap-based out-of-bounds read in DcmRLECodecDecoder::decod…4.4
• CVE-2026-44035Uncontrolled recursion in DcmDicomDir::moveRecordToTree() in…5.5
• CVE-2026-44036Uncontrolled mutual recursion between DcmXMLParseHelper::par…5.5
• CVE-2026-44037Uncontrolled mutual recursion between DcmJSONReader::parseDa…5.5
• CVE-2026-44038A global out-of-bounds read in the Huffman decoder of the bu…4.4