CVE-2026-44037: OFFIS DCMTK DoS Vulnerability

CVE-2026-44037 Overview

CVE-2026-44037 is a denial-of-service vulnerability in OFFIS DCMTK 3.7.0, a widely deployed DICOM toolkit used by medical imaging systems. The flaw resides in the DcmJSONReader class within dcmdata/libsrc/dcjsonrd.cc, where mutual recursion between parseDataSet(), parseElement(), and parseSequence() is unbounded. An attacker who supplies a crafted DICOM JSON document with deeply nested sequence (SQ) values can exhaust the thread stack and crash the parsing process. The json2dcm command-line tool and any service that converts untrusted DICOM JSON — including DICOMweb endpoints — are affected.

Critical Impact

Attackers can crash DICOM JSON processing services by submitting a single malformed payload, disrupting medical imaging workflows that rely on DCMTK for format conversion.

Affected Products

• OFFIS DCMTK 3.7.0 (dcmdata module)
• The json2dcm conversion utility bundled with DCMTK
• Downstream applications and DICOMweb services embedding DcmJSONReader for untrusted JSON ingestion

Discovery Timeline

• 2026-10-08 - CVE-2026-44037 published to NVD
• 2026-10-08 - Last updated in NVD database
• Fix committed to the DCMTK repository in commit cf955e64c35a1e07ba10698f639d5dcdec53b9d7

Technical Details for CVE-2026-44037

Vulnerability Analysis

The vulnerability is classified as uncontrolled recursion [CWE-674]. DICOM JSON representations may contain sequence (SQ) elements, which themselves contain items that are datasets, which may again contain SQ elements. The DCMTK parser models this hierarchy by having parseDataSet(), parseElement(), and parseSequence() call each other recursively without any depth accounting. Each recursive call consumes stack frames for local variables and parser state. A JSON document that nests SQ elements thousands of layers deep forces the process to exhaust its stack and terminate with a segmentation fault.

The impact is limited to availability. The parser does not corrupt memory or allow attacker-controlled code execution. However, in clinical settings where DICOMweb services ingest third-party study data, a single crafted request can take an imaging pipeline offline.

Root Cause

The three parsing routines in dcjsonrd.cc lacked a depth parameter and a corresponding limit check. Because DICOM SQ nesting is attacker-controlled in untrusted JSON, the recursion depth is bounded only by the operating system's stack size.

Attack Vector

Exploitation requires that an attacker-supplied DICOM JSON document reach a process using DcmJSONReader. In the json2dcm case, this is a local user converting a file. In DICOMweb deployments, the vector is network-reachable through STOW-RS and QIDO-RS endpoints that accept application/dicom+json. User interaction is required to initiate the parse in the CLI scenario.

// Patch excerpt from dcmdata/libsrc/dcjsonrd.cc
OFCondition DcmJSONReader::parseElement(
    DcmItem* dataset,
    DcmItem* metaheader,
+   size_t depth,
    OFJsmnTokenPtr& current)
{
+   if (depth > DCMJSON_MAX_SEQUENCE_NESTING)
+   {
+       DCMDATA_ERROR("DcmJSONReader: maximum sequence nesting level "
+           << DCMJSON_MAX_SEQUENCE_NESTING << " exceeded");
+       return EC_NestingDepthLimitExceeded;
+   }

    OFCondition result = EC_Normal;
    DCMDATA_TRACE("element at " << current->start);

Source: GitHub Commit cf955e6

Detection Methods for CVE-2026-44037

Indicators of Compromise

• Unexpected crashes or SIGSEGV termination of json2dcm or any process linked against DCMTK dcmdata
• Core dumps whose stack traces show deep recursion through DcmJSONReader::parseDataSet, parseElement, and parseSequence
• DICOMweb HTTP requests containing JSON payloads with abnormally large or repeating "vr":"SQ" nesting

Detection Strategies

• Inspect DICOM JSON payloads at the ingress layer and alert when sequence nesting exceeds a reasonable clinical depth (typically fewer than 32 levels).
• Monitor process restarts and crash telemetry on hosts running PACS, VNA, or DICOMweb services for repeated DcmJSONReader faults.
• Correlate client IP addresses that submit malformed DICOM JSON with subsequent service restarts to identify abuse.

Monitoring Recommendations

• Enable systemd or supervisor crash logging for DCMTK-based services and forward logs to a central SIEM.
• Track HTTP 5xx error rates on DICOMweb STOW-RS endpoints as an early signal of parser failure.
• Baseline normal payload sizes for DICOM JSON submissions and alert on statistical outliers.

How to Mitigate CVE-2026-44037

Immediate Actions Required

• Rebuild DCMTK from source after applying commit cf955e64c35a1e07ba10698f639d5dcdec53b9d7, or upgrade to the next DCMTK release that incorporates the fix.
• Restrict access to json2dcm and DICOMweb ingestion endpoints to authenticated, trusted clients only.
• Enforce a maximum request body size on reverse proxies in front of DICOMweb services to limit attack payload size.

Patch Information

The fix adds a depth parameter to the recursive parsers and returns EC_NestingDepthLimitExceeded once DCMJSON_MAX_SEQUENCE_NESTING is reached. See the GitHub Commit Overview and DCMTK Issue #1225 for upstream details.

Workarounds

• Pre-validate incoming DICOM JSON with a lightweight parser that rejects documents exceeding a nesting threshold before handing them to DCMTK.
• Run DCMTK-based conversion services under process isolation (containers, systemd units with Restart=on-failure) so that crashes do not take down adjacent workloads.
• Disable or firewall off json2dcm usage against untrusted input until the patched build is deployed.

# Example nginx guard: cap DICOMweb JSON body size and reject oversized payloads
location /dicom-web/studies {
    client_max_body_size 10m;
    proxy_pass http://dicomweb_backend;
}