Orthanc Server CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH Orthanc Server CVE published 2026-04-09

CVE-2026-5438

A gzip decompression bomb vulnerability exists in Orthanc when processing HTTP requests with `Content-Encoding: gzip`. The server does not enforce limits on decompressed size and allocates memory based on attacker-controlled compression metadata. A specially crafted gzip payload can trigger excessive memory allocation and exhaust system memory. This vulnerability may impact Orthanc server deployments that [truncated]