Read the docs
TI-2026-75324 Aliases CVE-2026-105273

J4Care dcm4che Loop with Unreachable Exit Condition

Priority MEDIUM 44CWE-835Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-835.

Summary

MP4Parser does not adequately validate MP4 box sizes. A malformed box can stop parsing from making forward progress, so the same input is processed repeatedly (CWE-835). The flaw affects dcm4chee-arc-light from 5.35.1 and has a CVSS 4.0 base score of 8.7 (HIGH). An attacker needs network access only, with no privileges or user interaction, and can cause high availability impact.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

MP4Parser does not adequately validate MP4 box sizes. A malformed box can cause parsing to make no forward progress and repeatedly process the same input.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00377 31st percentileScored 2026-11-07
Fix Fixed dcm4chee-arc-light (J4Care): 5.35.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
J4Caredcm4chee-arc-light5.35.15.35.2Patch availableCNA
  • dcm4chee-arc-light VendorJ4Care Affected 5.35.1 Fixed in 5.35.2 Patch available CNA

Remediation

Upgrade dcm4chee-arc-light to 5.35.2, which fixes the issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA dcm4chee-arc-light (J4Care) Fixed in 5.35.2

Timeline

  1. 2026-10-16 Threatist record created from CVE-2026-105273

References

Other 2

  • TI-2026-75325 J4Care dcm4che Missing Authentication for Critical Function CVSS 4.0CRITICAL 9.3
  • TI-2026-75334 Missing authorization in dcm4chee-arc-light enables object deletion CVSS 4.0HIGH 8.8
  • TI-2026-75328 Infinite loop in J4Care dcm4chee-arc-light JPEG parser CVSS 4.0HIGH 8.7
  • TI-2026-75323 Inefficient algorithm in J4Care dcm4chee-arc-light multipart parsing CVSS 4.0HIGH 8.7
  • TI-2026-75326 dcm4chee-arc-light accepts unauthenticated HL7 patient-merge messages CVSS 4.0HIGH 8.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences