CVE-2026-44037 OFFIS CVE debrief

Who should care

Defenders handling DICOM JSON documents, particularly in healthcare and medical imaging contexts, should assess exposure and consider remediation. The vulnerability allows an attacker to cause a denial of service via a crafted DICOM JSON document with deeply nested sequence (SQ) values. Defenders should assess exposure, particularly for systems handling DICOM JSON documents.

Why it matters

CVE-2026-44037 is a medium-severity vulnerability in the DCMTK JSON reader, allowing denial-of-service attacks via crafted DICOM JSON documents. Defenders handling DICOM JSON should assess exposure and consider applying the available fix.

• Potential for denial-of-service attacks
• Need for verification of affected versions
• Remediation priority for systems handling DICOM JSON

Technical summary

The DCMTK JSON reader is vulnerable to uncontrolled recursion, allowing an attacker to cause a denial of service via a crafted DICOM JSON document with deeply nested sequence (SQ) values. The vulnerability allows an attacker to cause a denial of service via a crafted DICOM JSON document. The json2dcm tool and any service that converts untrusted DICOM JSON (for example, DICOMweb payloads) with this reader are affected. The issue is fixed in commit cf955e64c35a1e07ba10698f639d5dcdec53b9d7. The CVE record was published on 2026-10-08T12:55:12.628Z and has not been modified since then.

Defensive priority

Medium priority for verification and remediation due to potential for denial-of-service attacks

Recommended defensive actions

• Verify exposure to DICOM JSON documents
• Assess systems handling DICOM JSON for potential denial-of-service attacks
• Consider applying the fix from commit cf955e64c35a1e07ba10698f639d5dcdec53b9d7
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, but additional information on affected versions and remediation is limited. There is a medium-severity vulnerability in the DCMTK JSON reader, allowing denial-of-service attacks via crafted DICOM JSON documents. Defenders handling DICOM JSON should assess exposure and consider applying the available fix. The CVE record was published on 2026-10-08T12:55:12.628Z and has not been modified since then. The json2dcm tool and any service that converts untrusted DICOM JSON (

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.