J4Care dcm4che
CISA warns J4Care dcm4chee-arc-light 5.35.1 flaws can delete images and expose patient data.
CISA's ICS medical advisory covers six vulnerabilities in J4Care dcm4chee-arc-light 5.35.1, a healthcare imaging archive. CVE-2026-97851, scored CVSS 9.1, lets an unauthenticated attacker change storage locations so the purge scheduler deletes referenced objects. Other flaws include infinite loops in JPEG and MP4 parsers, inefficient multipart processing, and a default configuration that accepts unregistered DICOM peers for C-FIND, C-GET, and forged C-STORE. J4Care recommends upgrading to 5.35.2 or later.
- dcm4chee-arc-light 5.35.1 is affected; the fix is release 5.35.2.
- CVE-2026-97851 scores CVSS 9.1 and can mark stored images for deletion.
- Default DICOM settings allow unauthenticated retrieval and forged study uploads.
- JPEG, MP4, and multipart parser flaws can cause denial of service.
- Vendors
- J4Care
- Products
- dcm4chee-arc-light
- Countries
- Austria
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-101021 | Multipart parser DoS in J4Care dcm4che | 8.7 | — | ||
| CVE-2026-105273 | Infinite-loop DoS in MP4Parser via malformed MP4 boxes | 8.7 | — | ||
| CVE-2026-105279 | Missing DICOM authentication in J4Care dcm4che archive | 9.3 | — | ||
CVE-2026-97851+2 related CVEs | Missing authorization lets attackers purge dcm4che storage | 8.8 group max | — |
From the original article
6 min read at cisa.govView CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to delete stored medical images, disclose patient information, inject forged studies, reassign patient records, overwrite files, and cause a denial-of-service condition. The following versions of J4Care dcm4che are affected: dcm4chee-arc-light 5. 35.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.