CVE-2026-5438

A gzip decompression bomb vulnerability exists when Orthanc processes HTTP request with `Content-Encoding: gzip`. The server does not enforce limits on decompressed size and allocates memory based on attacker-controlled compression metadata. A specially crafted gzip payload can trigger excessive memory allocation and exhaust system memory.

• CWE-770

• https://kb.cert.org/vuls/id/536588Third Party Advisory, VDB Entry
• https://www.machinespirits.de/Not Applicable
• https://www.orthanc-server.com/Product

Published

Apr 9, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54367CentreStack before 17.2 contains an authentication bypass vu…8.8
• CVE-2026-54368CentreStack before 17.4 contains a SQL injection vulnerabili…8.8
• CVE-2026-54369acl before version 2.4.0 contains a symlink traversal vulner…8.4
• CVE-2026-5437An out-of-bounds read vulnerability exists in `DicomStreamRe…7.5
• CVE-2026-54370acl before version 2.4.0 contains a time-of-check to time-of…7.2
• CVE-2026-54371attr before version 2.6.0 contains a symlink traversal vulne…8.4
• CVE-2026-54386marimo before 0.23.9 contains a reflected cross-site scripti…6.1
• CVE-2026-54387Tinyproxy through 1.11.3, fixed in commit ff45d3b, fails to …9.3
• CVE-2026-54388Tinyproxy through 1.11.3, fixed in commit 364cdb6, fails to …9.3
• CVE-2026-5439A memory exhaustion vulnerability exists in ZIP archive proc…7.5
• CVE-2026-54390JTL Shop versions 5.2.0 through 5.7.1 contains a server-side…9.8
• CVE-2026-54393A stored cross-site scripting vulnerability exists in MISP w…5.1