CVE-2026-44033

Uncontrolled recursion in XMLNode::ParseXMLElement() and XMLNode::emptyTheNode() in the bundled XML parser (ofstd/libsrc/ofxml.cc) of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaustion and process crash) via a crafted XML document with deeply nested elements. The parser is reachable through dcmencap when encapsulating a CDA document, and through any application that calls OFXMLParser::parseFile() or OFXMLParser::parseString() on untrusted input. The issue is fixed in commit d12e350e687530eb41e2b0c860aff4d8c04e5941.

• CWE-674

• https://github.com/DCMTK/dcmtk/commit/d12e350e687530eb41e2b0c860aff4d8c04e5941
• https://support.dcmtk.org/redmine/issues/1214

Published

Oct 8, 2026

Last Modified

Oct 8, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-44023Docling Core defines core data types and transformations for…8.6
• CVE-2026-44024Fluentd collects events from various data sources and writes…9.8
• CVE-2026-44025Fluentd collects events from various data sources and writes…7.5
• CVE-2026-44028An issue was discovered in Nix before 2.34.7 and Lix before …7.5
• CVE-2026-44029An issue was discovered in Nix before 2.34.7. Writing to arb…5.3
• CVE-2026-44031Uncontrolled recursion in DcmSequenceOfItems::read() and Dcm…7.5
• CVE-2026-44034A heap-based out-of-bounds read in DcmRLECodecDecoder::decod…4.4
• CVE-2026-44035Uncontrolled recursion in DcmDicomDir::moveRecordToTree() in…5.5
• CVE-2026-44036Uncontrolled mutual recursion between DcmXMLParseHelper::par…5.5
• CVE-2026-44037Uncontrolled mutual recursion between DcmJSONReader::parseDa…5.5
• CVE-2026-44038A global out-of-bounds read in the Huffman decoder of the bu…4.4
• CVE-2026-4404Use of hard coded credentials in GoHarbor Harbor version 2.1…9.4