{"id":"CVE-2026-44031","details":"Uncontrolled recursion in DcmSequenceOfItems::read() and DcmItem::read() in the dcmdata library of OFFIS DCMTK 3.7.0 allows a remote, unauthenticated attacker to cause a denial of service (stack exhaustion and process crash) via a DICOM dataset containing deeply nested sequences (SQ elements). The dataset can be sent in a C-STORE request to storescp, dcmrecv, dcmqrscp, or any other DICOM service built on DCMTK, because the received dataset is parsed before any authentication takes place. Local tools such as dcmdump also crash when opening such a file. The issue is fixed in commit 885ff0f10372bd589b5f44cea974f28a3964cb0f, which adds a configurable sequence nesting depth limit (default 64).","modified":"2026-10-10T07:05:55.809794265Z","published":"2026-10-08T13:17:17.027Z","database_specific":{},"references":[{"type":"WEB","url":"https://support.dcmtk.org/redmine/issues/1191"},{"type":"FIX","url":"https://github.com/DCMTK/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/dcmtk/dcmtk","events":[{"introduced":"0"},{"fixed":"885ff0f10372bd589b5f44cea974f28a3964cb0f"}],"database_specific":{"source":"REFERENCES"}}],"versions":["latest","DCMTK-3.7.0","DCMTK-3.6.9","DCMTK-3.6.8","DCMTK-3.6.7","DCMTK-3.6.5","DCMTK-3.6.6","DCMTK-3.6.5+_20191213","DCMTK-3.6.4","DCMTK-3.6.3","DCMTK-3.6.2","DCMTK-3.6.1_20170228","DCMTK-3.6.1_20161102","DCMTK-3.6.1_20160630","DCMTK-3.6.1_20160216","DCMTK-3.6.1_20150924","DCMTK-3.6.1_20150629","DCMTK-3.6.1_20150217","DCMTK-3.6.1_20140617","DCMTK-3.6.1_20131114","DCMTK-3.6.1_20121102","DCMTK-3.6.1_20120831","DCMTK-3.6.1_20120515","DCMTK-3.6.1_20120222","DCMTK-3.6.1_20111208","DCMTK-3.6.1_20110922","DCMTK-3.6.1_20110707","DCMTK-3.6.1_20110519","DCMTK-3.6.1_20110225","DCMTK-3.6.0","DCMTK-3.5.4","DCMTK-3.5.3","DCMTK-3.5.2a","DCMTK-3.5.2","DCMTK-3.5.1","DCMTK-3.5.0","DCMTK-3.4.2","DCMTK-3.4.1","DCMTK-3.4.0","DCMTK-3.3.1","DCMTK-3.3.0","DCMTK-3.2.1","DCMTK-3.2.0","DCMTK-3.1.2","DCMTK-3.1.1","DCMTK-3.1.0","CAR96-3.0.2","CAR96-3.0.1"],"database_specific":{"vanir_signatures":[{"id":"CVE-2026-44031-02c9ead1","signature_type":"Line","signature_version":"v1","source":"https://github.com/dcmtk/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f","target":{"file":"dcmdata/include/dcmtk/dcmdata/dcitem.h"},"deprecated":false,"digest":{"line_hashes":["88238609364975692370548715268803991392","249051495464410521141528724360074006635","80913883576157266836551071974461118050","247776402161534125448178064749433515566","64025567020696321334010664245492350555"],"threshold":0.9}},{"signature_version":"v1","source":"https://github.com/dcmtk/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f","target":{"file":"dcmdata/libsrc/dcitem.cc"},"deprecated":false,"digest":{"line_hashes":["236793011814673072250313060372610324076","167273616018612628298392957591921496401","92953127950849032365926128279559100332","49938571361326320797406960459210434524","236793011814673072250313060372610324076","167273616018612628298392957591921496401","92953127950849032365926128279559100332","49938571361326320797406960459210434524","264476321074613017467641509870843195196","201070500451849921611226041374723666196","239990100744491323181233019124813777789","122942970089730562164959843432277948049","339164428870443468996019408557426701392","166583233230805909861902440878618772217","36211575586771925758894545045106125041","256128107525997606043894360587975449422","131339062499029587804923668237481521524","72972829367696715929652742071031105460","14429616908889564713223168017804378321"],"threshold":0.9},"id":"CVE-2026-44031-12a08936","signature_type":"Line"},{"source":"https://github.com/dcmtk/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f","target":{"file":"dcmdata/libsrc/dcfilefo.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["162141217453372074662524841860662121760","312983999675835927335631713451518861303","284156689694739488069747013954669075364","233761324063025911253933183816001492115","162141217453372074662524841860662121760","312983999675835927335631713451518861303","284156689694739488069747013954669075364","181487418675805684842645679893608688741","54942413307623317152432788846733028103","152191121987512408022991540519585280793","113718685876369151428690681447398556567","240634145469104518616599068568715122080","242974284623604487922156026266877937521","120678701995436905852525364458285958767","221872257673316964622898017082269673311","116256373462186955413971350621644430463","38682780172975141478406498574505791518","104055884051393632977001508667117132646","65026636725919931122362468823437352632","155838377165578441582482896513761138966","80279465662043972783156442705704128406","232578465617334918291694887699240394667","200531233902356942971541402895023439614","173924152460020242762038832061205440589"]},"id":"CVE-2026-44031-156cda03","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/dcmtk/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f","target":{"file":"dcmnet/libsrc/scu.cc","function":"DcmSCU::DcmSCU"},"deprecated":false,"digest":{"function_hash":"330185888656851417666340724066308112911","length":782},"id":"CVE-2026-44031-2993eab1","signature_type":"Function"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/dcmtk/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f","target":{"file":"dcmdata/libsrc/dcdatset.cc"},"deprecated":false,"digest":{"line_hashes":["38682780172975141478406498574505791518","104055884051393632977001508667117132646","65026636725919931122362468823437352632","155838377165578441582482896513761138966","52834501376266510113523220332208945232","232578465617334918291694887699240394667","200531233902356942971541402895023439614","173924152460020242762038832061205440589"],"threshold":0.9},"id":"CVE-2026-44031-39cf770f"},{"signature_version":"v1","source":"https://github.com/dcmtk/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f","target":{"function":"DcmDataset::loadFileUntilTag","file":"dcmdata/libsrc/dcdatset.cc"},"deprecated":false,"digest":{"length":698,"function_hash":"228842641482655240605021571467789595780"},"id":"CVE-2026-44031-3f65a858","signature_type":"Function"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["113836015843579195615214672981085779838","171278011314473467103141805276229486004","174429017689594655616917902558513442622","97851517480019424554202101913749178794","71917939634695301329125276289393168206"]},"id":"CVE-2026-44031-41f4d695","signature_type":"Line","signature_version":"v1","source":"https://github.com/dcmtk/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f","target":{"file":"dcmdata/include/dcmtk/dcmdata/dcerror.h"}},{"id":"CVE-2026-44031-4352b4dc","signature_type":"Function","signature_version":"v1","source":"https://github.com/dcmtk/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f","target":{"file":"dcmdata/libsrc/dcitem.cc","function":"DcmItem::readUntilTag"},"deprecated":false,"digest":{"function_hash":"27803570932123978523075275249098196133","length":3482}},{"deprecated":false,"digest":{"function_hash":"308240186784173488803296395121188876472","length":464},"id":"CVE-2026-44031-4921f701","signature_type":"Function","signature_version":"v1","source":"https://github.com/dcmtk/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f","target":{"file":"dcmdata/libsrc/dcfilefo.cc","function":"DcmFileFormat::DcmFileFormat"}},{"source":"https://github.com/dcmtk/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f","target":{"file":"dcmdata/include/dcmtk/dcmdata/dcfilefo.h"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["259140037747176194524390387539822548179","56875555695671198495638737173370478394","322177048483761437119505563724341432062"]},"id":"CVE-2026-44031-4e5a3404","signature_type":"Line","signature_version":"v1"},{"target":{"function":"DcmSCU::receiveDIMSEDataset","file":"dcmnet/libsrc/scu.cc"},"deprecated":false,"digest":{"function_hash":"103137516347920301524087873940512342220","length":720},"id":"CVE-2026-44031-5e8a80e2","signature_type":"Function","signature_version":"v1","source":"https://github.com/dcmtk/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f"},{"signature_version":"v1","source":"https://github.com/dcmtk/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f","target":{"function":"DcmFileFormat::loadFileUntilTag","file":"dcmdata/libsrc/dcfilefo.cc"},"deprecated":false,"digest":{"function_hash":"248140613660407942970022067525487864602","length":987},"id":"CVE-2026-44031-61a07bcd","signature_type":"Function"},{"target":{"file":"dcmdata/libsrc/dcitem.cc","function":"DcmItem::DcmItem"},"deprecated":false,"digest":{"function_hash":"233385292454786740117323451658826855877","length":193},"id":"CVE-2026-44031-67ee5fba","signature_type":"Function","signature_version":"v1","source":"https://github.com/dcmtk/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/dcmtk/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f","target":{"file":"dcmnet/tests/tests.cc"},"deprecated":false,"digest":{"line_hashes":["112002847792759364397706020073552473598","130903578905647766071092849106378407669"],"threshold":0.9},"id":"CVE-2026-44031-6af40467"},{"digest":{"line_hashes":["31799629272127582985197796274920677834","308783703772647228448750639350430278019","9870322893850541779731586590890644758","166200380381647034166302528527776315792","151944501314997994955567042471672923570","291833787216187462388573516767889211041","245190644755596963962438245360759405553","243879078149459647001891396063028659474","302749898592811007501013185262795855783"],"threshold":0.9},"id":"CVE-2026-44031-6e203790","signature_type":"Line","signature_version":"v1","source":"https://github.com/dcmtk/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f","target":{"file":"dcmdata/libsrc/dcsequen.cc"},"deprecated":false},{"source":"https://github.com/dcmtk/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f","target":{"file":"dcmdata/libsrc/dcitem.cc","function":"operator="},"deprecated":false,"digest":{"length":572,"function_hash":"180963592842137496091546307104467661730"},"id":"CVE-2026-44031-80bee9d8","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-44031-81503b92","signature_type":"Function","signature_version":"v1","source":"https://github.com/dcmtk/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f","target":{"function":"DcmSCP::receiveDIMSEDataset","file":"dcmnet/libsrc/scp.cc"},"deprecated":false,"digest":{"function_hash":"301327964717854017840727704077015093662","length":807}},{"source":"https://github.com/dcmtk/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f","target":{"function":"DcmFileFormat::DcmFileFormat","file":"dcmdata/libsrc/dcfilefo.cc"},"deprecated":false,"digest":{"function_hash":"301480989758005585431683914810969132622","length":616},"id":"CVE-2026-44031-97fdba8a","signature_type":"Function","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/dcmtk/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f","target":{"file":"dcmnet/libsrc/scp.cc"},"deprecated":false,"digest":{"line_hashes":["124985748853853802052550445626765209138","316598267583678326353730265333456488292","335063704624970107783598043262943913552","42211384985223797821650828105113001921","227578951279942760154284059296137620366","161364919761222454056786200740831618177","50256042444111234098043631646404398368","41964351962433288145414059784303830292","216473288266488252539848859549598794121","38432020192851730719049554543293069457","188906312221643730212861497202638489899","980125832670831362428147524796078518","287752035077695200161370983161457366345","280032135279036693900113744352436130103","73994930608049966151332618666183194174","320288867634544154383157458153996132775","173556958900504212347219724305559188524"],"threshold":0.9},"id":"CVE-2026-44031-a08c4664"},{"signature_version":"v1","source":"https://github.com/dcmtk/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f","target":{"file":"dcmdata/libsrc/dcitem.cc","function":"privateCreatorCache"},"deprecated":false,"digest":{"function_hash":"17521631950675181706209319900625772137","length":334},"id":"CVE-2026-44031-a1cd5700","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/dcmtk/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f","target":{"file":"dcmdata/include/dcmtk/dcmdata/dcobject.h"},"deprecated":false,"digest":{"line_hashes":["78252311383533759621059030838332810677","337140346108702399635632392574913295666","54873546147047355266362866142321839695","163767919242601542440242824020503994841"],"threshold":0.9},"id":"CVE-2026-44031-a3f26faf","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/dcmtk/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f","target":{"file":"dcmdata/libsrc/dcfilefo.cc","function":"DcmFileFormat::DcmFileFormat"},"deprecated":false,"digest":{"function_hash":"55010672410095245530692997819095081726","length":255},"id":"CVE-2026-44031-a5fd72a6","signature_type":"Function"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/dcmtk/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f","target":{"file":"dcmnet/include/dcmtk/dcmnet/scp.h"},"deprecated":false,"digest":{"line_hashes":["237909340918838564059743058052338559526","337177653907148305082886855542853878808","31180389016062869938263020312030244695","144946011861936213030268931444908530235","61785628002405978260616244959281011615","291179905588318541726693095015073892365","169741787905745937127017666465406383960","111642369821826094138354693338713911789","214835867258434630913184719848664407189"],"threshold":0.9},"id":"CVE-2026-44031-a65dc1f4"},{"target":{"file":"dcmdata/libsrc/dcsequen.cc","function":"DcmSequenceOfItems::read"},"deprecated":false,"digest":{"function_hash":"42538246107604709154513274339431396466","length":1831},"id":"CVE-2026-44031-ab6371a1","signature_type":"Function","signature_version":"v1","source":"https://github.com/dcmtk/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f"},{"deprecated":false,"digest":{"length":114,"function_hash":"65502659688450508930150203597814880103"},"id":"CVE-2026-44031-b82bc86a","signature_type":"Function","signature_version":"v1","source":"https://github.com/dcmtk/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f","target":{"file":"dcmnet/libsrc/scp.cc","function":"DcmSCP::DcmSCP"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/dcmtk/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f","target":{"file":"dcmdata/libsrc/dcistrma.cc","function":"DcmInputStream::DcmInputStream"},"deprecated":false,"digest":{"length":133,"function_hash":"97935073973557880975019222075842935799"},"id":"CVE-2026-44031-c67cd988"},{"signature_version":"v1","source":"https://github.com/dcmtk/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f","target":{"file":"dcmdata/tests/tests.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["42785369464058843538226827521822982746","149979370217108428574067471714410735297","309860639139384541277428363611799190919"]},"id":"CVE-2026-44031-cffdfdc5","signature_type":"Line"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/dcmtk/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f","target":{"file":"dcmnet/libsrc/scu.cc"},"deprecated":false,"digest":{"line_hashes":["150283283817342917751155989659229137906","85556372029583432484320202835922008102","63517451048119552980482808952352406","58390076699891678351447374080591374634","332459884949738184458040250542957908542","8647750235805851055550890636317903117","50557582904768347768549314073135456022","41964351962433288145414059784303830292","216473288266488252539848859549598794121","38432020192851730719049554543293069457","188906312221643730212861497202638489899","207108111455038338056225274911545424478","275156015571040875717381897144943242230","108130103650867421329819724243418011343","240191324593329261673513635685010101970","167644973932610156037591254215153731665","98769666420014548323745987513350827781"],"threshold":0.9},"id":"CVE-2026-44031-d3c71789"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/dcmtk/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f","target":{"file":"dcmnet/include/dcmtk/dcmnet/scu.h"},"deprecated":false,"digest":{"line_hashes":["112390600507386179164736370898939552287","298569335724668850162116383970314422625","285473771516825404338306124734365393353","91296256783143341954373355638639492896","294320199627968664310271754135515283261","210936298186673595908980413905049666555","329442566199833318889089575572600148605","256911087501572627219635813886289998607","111319153987184749579977857285752617467"],"threshold":0.9},"id":"CVE-2026-44031-e3be736d"},{"digest":{"line_hashes":["145811959456411228945486535320389804561","5775225625182196780520464284226347645","117820589054561048756241998886846690152","247013485370865122419726383650423042623","239877558909252769479273252967789003770","205781044058803878311716311298762878226","55546952840312055084268794344569922278","231310957508496678666202296730626548727"],"threshold":0.9},"id":"CVE-2026-44031-e9bb12f6","signature_type":"Line","signature_version":"v1","source":"https://github.com/dcmtk/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f","target":{"file":"dcmdata/libsrc/dcistrma.cc"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"115124560523781494795849359294634311842","length":286},"id":"CVE-2026-44031-f0bef74b","signature_type":"Function","signature_version":"v1","source":"https://github.com/dcmtk/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f","target":{"file":"dcmdata/libsrc/dcfilefo.cc","function":"operator="}},{"target":{"file":"dcmdata/libsrc/dcitem.cc","function":"DcmItem::DcmItem"},"deprecated":false,"digest":{"function_hash":"205890316368674608282278135265679420572","length":229},"id":"CVE-2026-44031-f6b8d969","signature_type":"Function","signature_version":"v1","source":"https://github.com/dcmtk/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/dcmtk/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f","target":{"file":"dcmdata/include/dcmtk/dcmdata/dcistrma.h"},"deprecated":false,"digest":{"line_hashes":["10936062220580133686343854796432399886","152132778633404190218114230132115745460","204111294850913647163317468787086587878","16925144763443591460292917281694457754","266423645604197214560886247861516677405","162004281120646897414782609198547639951","193154211619780310149896225259776850461"],"threshold":0.9},"id":"CVE-2026-44031-f85fbd57"},{"target":{"file":"dcmnet/tests/tscuscp.cc"},"deprecated":false,"digest":{"line_hashes":["231882325236637000693329960198810541899"],"threshold":0.9},"id":"CVE-2026-44031-f892ec8b","signature_type":"Line","signature_version":"v1","source":"https://github.com/dcmtk/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f"},{"target":{"file":"dcmdata/libsrc/dcerror.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["129222959818491042024521865853866630246","275137403909641673257985981769683535585","329432288339278530081012387994125733009","223893529667213587683941794793713101597"]},"id":"CVE-2026-44031-f8a71ad2","signature_type":"Line","signature_version":"v1","source":"https://github.com/dcmtk/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f"}],"vanir_signatures_modified":"2026-10-10T07:05:55Z","source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44031.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}]}