EUVD-2026-102893Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed multipart/DICOMweb endpoint
-
ExploitSend crafted multipart payload
-
ExecutionForce excessive boundary matching and buffer copying
-
ImpactExhaust CPU/memory, denial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V2 - Validation and Business Logic Algorithmic complexity limits
|
| Exploitation Conditions | Requires only that a dcm4chee-arc-light instance exposes a network-reachable endpoint that parses multipart input (e.g., the DICOMweb STOW-RS upload interface) to the attacker; per PR:N the attacker needs no authentication and per UI:N no user interaction. The concrete prerequisite is the processing of attacker-supplied multipart payloads by MultipartInputStream. Limiting factors: impact is confined to availability (service slowdown/exhaustion) with no confidentiality or integrity effect, and exploitation requires the affected multipart-accepting service to be reachable from the attacker's network position - instances firewalled to trusted clinical networks substantially reduce exposure. |
| Impact | The input CVSS 4.0 base score of 8.7 (High) reflects a remote, low-complexity, unauthenticated vector (AV:N/AC:L/AT:N/PR:N/UI:N) with impact confined entirely to availability (VA:H; VC:N/VI:N). This is consistent with CWE-407 (Inefficient Algorithmic Complexity): the flaw is a denial-of-service/resource-exhaustion issue in MultipartInputStream, NOT a data-exposure bug. This directly CONFLICTS with the 'Information Disclosure' tag in the input, which is unsupported by the vector (confidentiality and integrity are both N) - the tag should be disregarded. No EPSS probability, CISA KEV listing, or POC indicator was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net assessment: the high score is driven by easy remote reachability rather than severe impact - a single-dimension (availability) DoS. In most contexts this is a medium-urgency patch, but the healthcare/medical-imaging deployment context (dcm4chee-arc-light, surfaced via a CISA ICS medical advisory) elevates operational concern because availability loss of a DICOM/PACS archive can affect clinical workflows and patient care. Treat as a real but non-catastrophic priority; the absence of exploitation signals (EPSS/KEV/POC) suggests it is not yet under widespread attack. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a specially crafted multipart HTTP request (e.g., to a DICOMweb/STOW-RS upload endpoint) whose structure maximizes boundary comparisons and buffer copying in MultipartInputStream. Parsing the malicious payload consumes disproportionate CPU and memory, degrading or denying service to legitimate users. No public exploit code is identified in the provided data, but the low attack complexity makes a working DoS trivial to develop. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 16, 2026
Remote, unauthenticated attackers can exhaust dcm4chee-arc-light by submitting crafted multipart payloads to its MultipartInputStream parser, which performs inefficient boundary matching and unnecessary buffer copying, driving excessive boundary comparisons and repeated copies that consume CPU and memory until the service slows or becomes unavailable. Every version captured by cpe:2.3:a:j4care:dcm4chee-arc-light:*:*:*:*:*:*:*:* is affected, and the impact is confined to availability (VC:N/VI:N/VA:H) with no confidentiality or integrity effect. No public exploit identified at time of analysis, but exploitation requires only that a multipart-accepting endpoint such as the DICOMweb STOW-RS upload interface be network-reachable to the attacker; the vendor-classified CVSS 4.0 base of 8.7 (High) matches an independent assessment of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Earlier versions of this analysis (1)
Denial of service in dcm4chee-arc-light allows unauthenticated remote attackers to degrade or stall a multipart-consuming service endpoint by sending crafted multipart content that forces excessive boundary comparisons and repeated buffer copying inside MultipartInputStream (CWE-407). The assessed CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) makes this a network-reachable, low-complexity, unauthenticated, availability-only issue - there is no confidentiality or integrity impact in the assessed vector, and exploitation depends on the target exposing an endpoint that parses multipart input. No public exploit identified at time of analysis, the CVE is not in CISA KEV, and the authoritative source is CISA's ICS medical advisory ICSMA-26-288-02 (reported by ICS-CERT); risk is materially reduced where the archive is network-segmented, access-controlled, or not internet-facing.
RemediationAI
No vendor-released patch identified at time of analysis, so the available data does not supply an exact fixed version - administrators should monitor the CISA ICS medical advisory ICSMA-26-288-02 (https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-02) and the j4care/dcm4che project release channels for a patched MultipartInputStream build, and apply it as soon as it appears. Until then, the highest-value control is to remove network reachability from untrusted sources: firewall or segment the DICOMweb STOW-RS and any other multipart-accepting endpoints so they are reachable only from trusted clinical networks and known PACS/imaging clients, which mirrors the limiting factor that instances already firewalled to trusted networks are substantially less exposed; the trade-off is that legitimate remote or mobile uploaders will be blocked and will need a VPN or jump path. Second, place a reverse proxy or WAF in front of the service and cap multipart request body size, cap concurrent uploads per client, and enforce per-IP rate limits on the upload path to blunt the amplification; the trade-off is that aggressive size limits can reject legitimate large DICOM studies and must be tuned to the largest expected object. Third, set CPU and memory limits (container limits, JVM heap caps, cgroup quotas) and enable request timeouts on the multipart endpoints so a single abusive request is aborted rather than allowed to monopolize resources, accepting that legitimate long-running uploads may time out under load. Finally, alert on abnormal per-request CPU or latency spikes correlated with multipart uploads so attempts are detected early, while noting that these measures reduce but do not eliminate the underlying algorithmic weakness.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is an instance of CWE-407, Inefficient Algorithmic Complexity, located in the MultipartInputStream component that dcm4chee-arc-light uses to parse attacker-supplied multipart input - the same encoding consumed by DICOMweb services such as STOW-RS, where imaging objects are uploaded as multipart/related bodies. Instead of scanning the input once with bounded work per byte, the parser compares candidate boundary sequences inefficiently and repeatedly copies buffer contents, so a crafted payload with adversarial boundary placement forces a disproportionate number of comparisons and re-copies relative to input length. The result is a classic algorithmic-complexity denial of service: request processing time and heap/CPU consumption scale far faster than payload size, letting an attacker amplify a modest request into sustained resource starvation of the archive. The listed CPE cpe:2.3:a:j4care:dcm4chee-arc-light:*:*:*:*:*:*:*:* indicates the flaw is present across the product line rather than being pinned to a single build, and because the issue lives in parsing logic that runs before application-level authorization checks complete on the request body, the CVSS 4.0 vector's PR:N/UI:N values are consistent with an unauthenticated, no-user-interaction attack path against any exposed multipart endpoint.
Know when Dcm4Chee Arc Light gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Remote unauthenticated multipart parsing with low complexity gives AV:N/AC:L/PR:N/UI:N; CWE-407 resource exhaustion yields A:H only, with C:N/I:N.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
2DescriptionCVE.org
MultipartInputStream performs inefficient boundary matching and unnecessary buffer copying. Crafted multipart input can force excessive boundary comparisons and repeated copying.
Executive ViewAI
An unauthenticated attacker with network access to J4Care's dcm4chee-arc-light can degrade or halt the medical imaging archive by sending malformed multipart uploads to its DICOMweb STOW-RS interface, and no vendor fix is currently available. Because this platform is the system of record for diagnostic images, an outage can stall radiology reads, delay image transfer between departments, and block clinical access to prior studies, making this an operational continuity risk rather than a data-breach risk. Every version in the affected product line is exposed, so leadership should treat this as a service-availability exposure requiring isolation and monitoring rather than a patching exercise.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network reachability of multipart-accepting endpoints such as the DICOMweb STOW-RS interface to trusted clinical sources, segment the archive from general user and internet-facing networks, enforce request-size limits and rate limiting at the reverse proxy or WAF, monitor CPU and memory for exhaustion patterns with alerting, and prepare failover or degraded-mode procedures for imaging workflows while awaiting a vendor fix.
Threat Intelligence Overview
NVD
CVE.org
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
More in Dcm4Chee Arc Light
View allUnauthenticated remote peers can query and download patient demographics and medical imagery from dcm4chee-arc-light arc
Unauthenticated remote attackers can irreversibly delete stored DICOM objects in dcm4chee-arc-light by invoking the stor
Unauthenticated HL7 ADT^A40 patient-merge messages accepted by the dcm4chee-arc-light archive's default listener let a r
Malformed MP4 box-size fields submitted to the MP4Parser component in j4care dcm4chee-arc-light drive the parser into a
JPEGParser in j4care's dcm4chee-arc-light can be driven into an infinite loop by a specially crafted or truncated JPEG-e
Exploit-DB