Read the docs
TI-2026-75323 Aliases CVE-2026-101021

Inefficient algorithm in J4Care dcm4chee-arc-light multipart parsing

Priority MEDIUM 44CWE-407Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-407.

Summary

J4Care dcm4chee-arc-light versions from 5.35.1 before 5.35.2 are affected. The MultipartInputStream class uses inefficient boundary matching and unnecessary buffer copying, which is CWE-407. A remote attacker without privileges or user interaction can send crafted multipart input that forces excessive boundary comparisons and repeated copying, degrading availability.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

MultipartInputStream performs inefficient boundary matching and unnecessary buffer copying. Crafted multipart input can force excessive boundary comparisons and repeated copying.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00377 31st percentileScored 2026-11-07
Fix Fixed dcm4chee-arc-light (J4Care): 5.35.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
J4Caredcm4chee-arc-light5.35.15.35.2Patch availableCNA
  • dcm4chee-arc-light VendorJ4Care Affected 5.35.1 Fixed in 5.35.2 Patch available CNA

Remediation

Upgrade J4Care dcm4chee-arc-light to version 5.35.2 or later.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA dcm4chee-arc-light (J4Care) Fixed in 5.35.2

Timeline

  1. 2026-10-16 Threatist record created from CVE-2026-101021

References

Other 2

  • TI-2026-75325 J4Care dcm4che Missing Authentication for Critical Function CVSS 4.0CRITICAL 9.3
  • TI-2026-75334 Missing authorization in dcm4chee-arc-light enables object deletion CVSS 4.0HIGH 8.8
  • TI-2026-75328 Infinite loop in J4Care dcm4chee-arc-light JPEG parser CVSS 4.0HIGH 8.7
  • TI-2026-75324 J4Care dcm4che Loop with Unreachable Exit Condition CVSS 4.0HIGH 8.7
  • TI-2026-75326 dcm4chee-arc-light accepts unauthenticated HL7 patient-merge messages CVSS 4.0HIGH 8.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences