CVE-2026-44033

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-44033
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44033.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-44033
Downstream
Published
2026-10-08T13:17:17Z
Modified
2026-10-10T07:06:17Z
Severity
  • 6.8 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator
Summary
[none]
Details

Uncontrolled recursion in XMLNode::ParseXMLElement() and XMLNode::emptyTheNode() in the bundled XML parser (ofstd/libsrc/ofxml.cc) of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaustion and process crash) via a crafted XML document with deeply nested elements. The parser is reachable through dcmencap when encapsulating a CDA document, and through any application that calls OFXMLParser::parseFile() or OFXMLParser::parseString() on untrusted input. The issue is fixed in commit d12e350e687530eb41e2b0c860aff4d8c04e5941.

References

Affected packages

Git / github.com/dcmtk/dcmtk

Affected ranges

Type
GIT
Repo
https://github.com/dcmtk/dcmtk
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
d12e350e687530eb41e2b0c860aff4d8c04e5941
Database specific
Show details 
{
    "source": "REFERENCES"
}

Affected versions

CAR96-3.*
CAR96-3.0.1
CAR96-3.0.2
DCMTK-3.*
DCMTK-3.1.0
DCMTK-3.1.1
DCMTK-3.1.2
DCMTK-3.2.0
DCMTK-3.2.1
DCMTK-3.3.0
DCMTK-3.3.1
DCMTK-3.4.0
DCMTK-3.4.1
DCMTK-3.4.2
DCMTK-3.5.0
DCMTK-3.5.1
DCMTK-3.5.2
DCMTK-3.5.2a
DCMTK-3.5.3
DCMTK-3.5.4
DCMTK-3.6.0
DCMTK-3.6.1_20110225
DCMTK-3.6.1_20110519
DCMTK-3.6.1_20110707
DCMTK-3.6.1_20110922
DCMTK-3.6.1_20111208
DCMTK-3.6.1_20120222
DCMTK-3.6.1_20120515
DCMTK-3.6.1_20120831
DCMTK-3.6.1_20121102
DCMTK-3.6.1_20131114
DCMTK-3.6.1_20140617
DCMTK-3.6.1_20150217
DCMTK-3.6.1_20150629
DCMTK-3.6.1_20150924
DCMTK-3.6.1_20160216
DCMTK-3.6.1_20160630
DCMTK-3.6.1_20161102
DCMTK-3.6.1_20170228
DCMTK-3.6.2
DCMTK-3.6.3
DCMTK-3.6.4
DCMTK-3.6.5
DCMTK-3.6.5+_20191213
DCMTK-3.6.6
DCMTK-3.6.7
DCMTK-3.6.8
DCMTK-3.6.9
DCMTK-3.7.0
Other
latest

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44033.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "273064793590780333490402872314950753469",
            "length": 5166
        },
        "id": "CVE-2026-44033-1ae30ad3",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/dcmtk/dcmtk/commit/d12e350e687530eb41e2b0c860aff4d8c04e5941",
        "target": {
            "file": "ofstd/libsrc/ofxml.cc",
            "function": "XMLNode::ParseXMLElement"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "120424057595109747157020487388493811927",
                "96866522703757414538719377823868334516",
                "235937649455399215090573105420808827370",
                "297797722230679246297287068583497491559",
                "170413518604887921802846968620570901189",
                "252031083353727882279527770435383423652",
                "282967483847703224629697395475493131391",
                "10144250123956314794591653103527672623",
                "130970036434669852056523464522133914902",
                "205436454243759327128002872438028069019",
                "306309611673135049555245415732485150887",
                "183474959394183625677603537551427571609",
                "252766733665709575358535515459853509640",
                "24868714223192333539765545345009538164",
                "272358197928790640520944874006995150505",
                "259079798642667506065855235807442184155",
                "268422405527428173466227688723296344179",
                "49774667107722301184792153273114467881",
                "290224579607758226581799954707217143385",
                "281719063058040211063612882414822201953",
                "293388817368841649348381610581939270420",
                "182720413935423225501175078001830120216",
                "168120449374764090408695570840128094411",
                "157353239438560866541731506786404439069",
                "95569140065029953163591475140069202191",
                "150063103051838592992334247199704043369",
                "84251108428566341183197718557469772343",
                "299214092851999206026363632977062644651",
                "318290543427725973081553386909215741670",
                "190023162867304020860343491372211654898",
                "230420704759401822252802091505509835068",
                "163613591389324556041105025849108965092",
                "160152016565133983931493167049330955648",
                "259456286981238922235805754456458744227",
                "80573784112490819369913490124196503759",
                "237912059873392811694042581902950973245",
                "254184799239351754989672389866164280629",
                "105974941192396294200235938602635864340",
                "192014760700465594902727672295009262605"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-44033-21723dd6",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/dcmtk/dcmtk/commit/d12e350e687530eb41e2b0c860aff4d8c04e5941",
        "target": {
            "file": "ofstd/libsrc/ofxml.cc"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "15741948462381523450400642678324439971",
            "length": 180
        },
        "id": "CVE-2026-44033-3a3c44c4",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/dcmtk/dcmtk/commit/d12e350e687530eb41e2b0c860aff4d8c04e5941",
        "target": {
            "file": "ofstd/libsrc/ofxml.cc",
            "function": "operator="
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "35541841611799773879740104976521469633",
            "length": 1326
        },
        "id": "CVE-2026-44033-4e63ba5b",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/dcmtk/dcmtk/commit/d12e350e687530eb41e2b0c860aff4d8c04e5941",
        "target": {
            "file": "ofstd/libsrc/ofxml.cc",
            "function": "XMLNode::emptyTheNode"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "246127718439257322486335530527517011542",
                "47631257766089677813354128536263380344",
                "122458075724312792436717533784745260472",
                "290590380965323960554728879398209873097",
                "840302359633510599445386714322718965",
                "324625307373604172619219041705268349009",
                "272856057258582445370370911199686379897",
                "186691173501867741268892581116441889462",
                "247713017610480834120625868133419486971",
                "236159428761565498848195223085445400454",
                "166503382249423421014381543299404254448",
                "201905517865175496167786962915189598332",
                "266060468413468181664361662121837972077",
                "31667585805837436978784633530018419751"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-44033-521732ce",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/dcmtk/dcmtk/commit/d12e350e687530eb41e2b0c860aff4d8c04e5941",
        "target": {
            "file": "ofstd/include/dcmtk/ofstd/ofxml.h"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "138833362891902561785941647873303545977",
            "length": 84
        },
        "id": "CVE-2026-44033-7dd82618",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/dcmtk/dcmtk/commit/d12e350e687530eb41e2b0c860aff4d8c04e5941",
        "target": {
            "file": "ofstd/libsrc/ofxml.cc",
            "function": "XMLNode::~XMLNode"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "283180224341232576503137373091571119079",
            "length": 1211
        },
        "id": "CVE-2026-44033-c8510420",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/dcmtk/dcmtk/commit/d12e350e687530eb41e2b0c860aff4d8c04e5941",
        "target": {
            "file": "ofstd/libsrc/ofxml.cc",
            "function": "XMLNode::parseString"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "218499052854263540938591394305293135590",
            "length": 2039
        },
        "id": "CVE-2026-44033-cc51651b",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/dcmtk/dcmtk/commit/d12e350e687530eb41e2b0c860aff4d8c04e5941",
        "target": {
            "file": "ofstd/libsrc/ofxml.cc",
            "function": "XMLNode::getError"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "179324437865223346539410495139617904933",
            "length": 162
        },
        "id": "CVE-2026-44033-df585b1c",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/dcmtk/dcmtk/commit/d12e350e687530eb41e2b0c860aff4d8c04e5941",
        "target": {
            "file": "ofstd/libsrc/ofxml.cc",
            "function": "XMLNode::deleteNodeContent"
        }
    }
]
vanir_signatures_modified 
"2026-10-10T07:06:17Z"