J4Care dcm4che
CISA warns J4Care dcm4chee-arc-light 5.35.1 flaws can delete images and expose patient data.
68
Vulnerability4 · 3 reads
CVE-2026-101021
Multipart parser DoS in J4Care dcm4che
- CVSS 4.0
- 8.7 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CVE-2026-101021 is an algorithmic-complexity denial-of-service flaw (CWE-407) in J4Care dcm4che’s MultipartInputStream. The parser matches multipart boundaries inefficiently and copies buffers more than necessary, so a crafted multipart request can force a large number of boundary comparisons and repeated copies. A remote attacker needs no privileges or user interaction; the CVSS 4.0 score is 8.7 with high impact to availability and no stated confidentiality or integrity impact. The issue affects deployments that parse multipart input with this dcm4che component; affected version ranges are not given in the supplied data. It is not listed in CISA KEV, and no public proof-of-concept is known.
What to do: Apply the vendor fix for dcm4che as soon as J4Care publishes patched builds; the supplied data does not name a fixed version. Until then, restrict unauthenticated access to HTTP endpoints that accept multipart bodies, cap request and part sizes, and watch archive or web services for CPU and memory spikes from crafted uploads.
| Product | Affected |
|---|---|
| J4Care dcm4che (MultipartInputStream) | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
MultipartInputStream performs inefficient boundary matching and unnecessary buffer copying. Crafted multipart input can force excessive boundary comparisons and repeated copying.
- Weakness
- CWE-407
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X