{"id":"CVE-2026-44037","details":"Uncontrolled mutual recursion between DcmJSONReader::parseDataSet(), DcmJSONReader::parseElement() and DcmJSONReader::parseSequence() in dcmdata/libsrc/dcjsonrd.cc of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaustion and process crash) via a crafted DICOM JSON document with deeply nested sequence (SQ) values. The json2dcm tool and any service that converts untrusted DICOM JSON (for example, DICOMweb payloads) with this reader are affected. The issue is fixed in commit cf955e64c35a1e07ba10698f639d5dcdec53b9d7.","modified":"2026-10-10T07:06:16.968220176Z","published":"2026-10-08T13:17:17.817Z","database_specific":{},"references":[{"type":"WEB","url":"https://support.dcmtk.org/redmine/issues/1225"},{"type":"FIX","url":"https://github.com/DCMTK/dcmtk/commit/cf955e64c35a1e07ba10698f639d5dcdec53b9d7"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/dcmtk/dcmtk","events":[{"introduced":"0"},{"fixed":"cf955e64c35a1e07ba10698f639d5dcdec53b9d7"}],"database_specific":{"source":"REFERENCES"}}],"versions":["latest","DCMTK-3.7.0","DCMTK-3.6.9","DCMTK-3.6.8","DCMTK-3.6.7","DCMTK-3.6.5","DCMTK-3.6.6","DCMTK-3.6.5+_20191213","DCMTK-3.6.4","DCMTK-3.6.3","DCMTK-3.6.2","DCMTK-3.6.1_20170228","DCMTK-3.6.1_20161102","DCMTK-3.6.1_20160630","DCMTK-3.6.1_20160216","DCMTK-3.6.1_20150924","DCMTK-3.6.1_20150629","DCMTK-3.6.1_20150217","DCMTK-3.6.1_20140617","DCMTK-3.6.1_20131114","DCMTK-3.6.1_20121102","DCMTK-3.6.1_20120831","DCMTK-3.6.1_20120515","DCMTK-3.6.1_20120222","DCMTK-3.6.1_20111208","DCMTK-3.6.1_20110922","DCMTK-3.6.1_20110707","DCMTK-3.6.1_20110519","DCMTK-3.6.1_20110225","DCMTK-3.6.0","DCMTK-3.5.4","DCMTK-3.5.3","DCMTK-3.5.2a","DCMTK-3.5.2","DCMTK-3.5.1","DCMTK-3.5.0","DCMTK-3.4.2","DCMTK-3.4.1","DCMTK-3.4.0","DCMTK-3.3.1","DCMTK-3.3.0","DCMTK-3.2.1","DCMTK-3.2.0","DCMTK-3.1.2","DCMTK-3.1.1","DCMTK-3.1.0","CAR96-3.0.2","CAR96-3.0.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44037.json","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/dcmtk/dcmtk/commit/cf955e64c35a1e07ba10698f639d5dcdec53b9d7","target":{"function":"DcmJSONReader::parseSequence","file":"dcmdata/libsrc/dcjsonrd.cc"},"deprecated":false,"digest":{"function_hash":"3151063552836454143579925605355491366","length":765},"id":"CVE-2026-44037-037132e3","signature_type":"Function"},{"digest":{"threshold":0.9,"line_hashes":["295595327814434902966558453940797416359","151564989957065944638988252805818691835","251230291637710973273694864004104221053","49638052528633696228520741080765075010","103451902836499905830367644810401922633","173564587058162768264389633749094123777","219056591428441305425083285375527015295","149245629089537804594582000730088769614","93778333246285734929371509846813085178","81240779247355753770213314624956433103","307326877289142519638705036329875421819","53101884674851380163813785773698430191","187007719326774731491401939615512026596","152644057898777210379351363209083221995","872972197259585522585422481602129380","185468354856519912792238472779026036531","248629408560507296074039676819423413489"]},"id":"CVE-2026-44037-2c567e05","signature_type":"Line","signature_version":"v1","source":"https://github.com/dcmtk/dcmtk/commit/cf955e64c35a1e07ba10698f639d5dcdec53b9d7","target":{"file":"dcmdata/include/dcmtk/dcmdata/dcjsonrd.h"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"79113733515627917187040541553775320139","length":5139},"id":"CVE-2026-44037-8e207e6d","signature_type":"Function","signature_version":"v1","source":"https://github.com/dcmtk/dcmtk/commit/cf955e64c35a1e07ba10698f639d5dcdec53b9d7","target":{"file":"dcmdata/libsrc/dcjsonrd.cc","function":"DcmJSONReader::parseElement"}},{"digest":{"line_hashes":["120295102010527893624252634993950101466","229021189211293565498286818634742022363","264303794931124191715513354036784376717","249987551211324093823939645332754263409","13962313352802895501668277860484353655","40133803347345345232879897412826336316","179508256844638000393002101832318195090","270184538790591719604021130402768815833","69661183596712304739410635176153620397","150583251492439251499110622075049618358","236927807472784084142423710259299817467","217093023467538699881237338009713600178","174630135337712511519005453794898380607","214933301348672707544988347734247545408","113656295989510326605714949596853537709","202423649517496497215298668082357106157","168245662858552153275360677489672574510","314392015410596899165384712861160352608","287102745818620667966736059469151367534","51513944622423747428782592079736767214","264303794931124191715513354036784376717","249987551211324093823939645332754263409","130022131015292781953095762633037381218","136366561084862825977156594967895717841","294334979847364295385133500689257400653","313717964994289501466360523956879007233","33826286486272397748739814827876320863","61991287316053114501805078495232932350","15308414988980134767373406039665348540","165475860014480921257179868031981506769","94353010201400406770834788089870877916","157703255486321993903501560344746451135","76004694139318162282945378490040474773","199364893510882006352220143940968079947","249166156818412329524601483439556384629","28845774097180403861779558251659284351","248100128598437742376017241308337059739","338471837641285438653343484923248324588","127714879961618405543027257609882895019","90312118786574091879294305804737920314","131903903147099427670818315044701403454","95449656544549678932097640082782415825","305002513581184878706061265511638460162","151598342243562190155962686735366649733"],"threshold":0.9},"id":"CVE-2026-44037-94cebf05","signature_type":"Line","signature_version":"v1","source":"https://github.com/dcmtk/dcmtk/commit/cf955e64c35a1e07ba10698f639d5dcdec53b9d7","target":{"file":"dcmdata/libsrc/dcjsonrd.cc"},"deprecated":false},{"target":{"function":"DcmJSONReader::readAndConvertJSONFile","file":"dcmdata/libsrc/dcjsonrd.cc"},"deprecated":false,"digest":{"function_hash":"235456037272922013251796102982281920795","length":2104},"id":"CVE-2026-44037-965303b4","signature_type":"Function","signature_version":"v1","source":"https://github.com/dcmtk/dcmtk/commit/cf955e64c35a1e07ba10698f639d5dcdec53b9d7"},{"signature_version":"v1","source":"https://github.com/dcmtk/dcmtk/commit/cf955e64c35a1e07ba10698f639d5dcdec53b9d7","target":{"file":"dcmdata/libsrc/dcjsonrd.cc","function":"DcmJSONReader::parseDataSet"},"deprecated":false,"digest":{"length":642,"function_hash":"256873923923624653950815006198187627983"},"id":"CVE-2026-44037-f89a5db6","signature_type":"Function"}],"vanir_signatures_modified":"2026-10-10T07:06:16Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}]}