J4Care dcm4che
CISA warns J4Care dcm4chee-arc-light 5.35.1 flaws can delete images and expose patient data.
68
Vulnerability2 · 1 read
CVE-2026-107621
Infinite loop in J4Care dcm4che JPEGParser
- CVSS 4.0
- 8.7 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
JPEGParser in J4Care dcm4che can enter an infinite loop while parsing a specially crafted or truncated JPEG stream (CWE-835). The flaw is reachable over the network with no privileges and no user interaction, and it does not by itself disclose or alter data. Impact is loss of availability: the parser or the process using it can hang and stop handling further images. Affected deployments are systems that use dcm4che’s JPEGParser; exact version ranges are not stated in the provided data. It is not on the CISA KEV list and no public proof-of-concept is known.
What to do: Apply the vendor fix for dcm4che as soon as J4Care publishes a patched release, and until then restrict which systems may send DICOM or JPEG streams to JPEGParser. Restart or isolate processes that stop responding while parsing images, and keep imaging services off untrusted networks.
| Product | Affected |
|---|---|
| J4Care dcm4che | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
JPEGParser can enter an infinite loop while parsing a specially crafted or truncated stream.
- Weakness
- CWE-835
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X