Read the docs
TI-2026-75328 Aliases CVE-2026-107621

Infinite loop in J4Care dcm4chee-arc-light JPEG parser

Priority MEDIUM 44CWE-835Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-835.

Summary

J4Care dcm4chee-arc-light from 5.35.1 before 5.35.2 is affected. The JPEGParser class can enter an infinite loop when it parses a specially crafted or truncated stream (CWE-835). An unauthenticated remote attacker can cause a high availability impact without user interaction.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

JPEGParser can enter an infinite loop while parsing a specially crafted or truncated stream.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00377 31st percentileScored 2026-11-07
Fix Fixed dcm4chee-arc-light (J4Care): 5.35.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
J4Caredcm4chee-arc-light5.35.15.35.2Patch availableCNA
  • dcm4chee-arc-light VendorJ4Care Affected 5.35.1 Fixed in 5.35.2 Patch available CNA

Remediation

Update J4Care dcm4chee-arc-light to version 5.35.2, which fixes this flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA dcm4chee-arc-light (J4Care) Fixed in 5.35.2

Timeline

  1. 2026-10-16 Threatist record created from CVE-2026-107621

References

Other 2

  • TI-2026-75325 J4Care dcm4che Missing Authentication for Critical Function CVSS 4.0CRITICAL 9.3
  • TI-2026-75334 Missing authorization in dcm4chee-arc-light enables object deletion CVSS 4.0HIGH 8.8
  • TI-2026-75324 J4Care dcm4che Loop with Unreachable Exit Condition CVSS 4.0HIGH 8.7
  • TI-2026-75323 Inefficient algorithm in J4Care dcm4chee-arc-light multipart parsing CVSS 4.0HIGH 8.7
  • TI-2026-75326 dcm4chee-arc-light accepts unauthenticated HL7 patient-merge messages CVSS 4.0HIGH 8.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences