CVE-2026-44033
published 2026-10-08CVE-2026-44033: Uncontrolled recursion in XMLNode::ParseXMLElement() and XMLNode::emptyTheNode() in the bundled XML parser (ofstd/libsrc/ofxml.cc) of OFFIS DCMTK 3.7.0 allows…
PriorityP419medium5.5CVSS 3.1
AVLACLPRNUIRSUCNINAH
EPSS
0.10%
1.0th percentile
Uncontrolled recursion in XMLNode::ParseXMLElement() and XMLNode::emptyTheNode() in the bundled XML parser (ofstd/libsrc/ofxml.cc) of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaustion and process crash) via a crafted XML document with deeply nested elements. The parser is reachable through dcmencap when encapsulating a CDA document, and through any application that calls OFXMLParser::parseFile() or OFXMLParser::parseString() on untrusted input. The issue is fixed in commit d12e350e687530eb41e2b0c860aff4d8c04e5941.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| offis | dcmtk | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
nvdv4.06.8MEDIUMCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
dcmtk: dcmtk: Denial of Service via deeply nested XML elements
vendor_redhat·2026-10-08·CVSS 5.5
CVE-2026-44033 [MEDIUM] CWE-770 dcmtk: dcmtk: Denial of Service via deeply nested XML elements
dcmtk: dcmtk: Denial of Service via deeply nested XML elements
A flaw was found in dcmtk. An attacker can trigger uncontrolled recursion by tricking a user or application into parsing a specially crafted XML document containing deeply nested elements. This flaw leads to stack exhaustion, causing the application to crash and resulting in a Denial of Service (DoS).
Statement: This vulnerability is rated as Moderate severity because exploitation requires an attacker to convince a user or automated process to handle a specially crafted XML file, resulting only in a denial of service without compromising data confidentiality or system integrity. In Red Hat environments, DCMTK is not included in supported Red Hat Enterprise Linux releases and is only available through community repositories su
GHSA
Uncontrolled recursion in XMLNode::ParseXMLElement() and XMLNode::emptyTheNode() in the bundled XML parser (ofstd/libsrc/ofxml.cc) of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service
ghsa_unreviewed·2026-10-08
CVE-2026-44033 [MEDIUM] CWE-674 Uncontrolled recursion in XMLNode::ParseXMLElement() and XMLNode::emptyTheNode() in the bundled XML parser (ofstd/libsrc/ofxml.cc) of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service
Uncontrolled recursion in XMLNode::ParseXMLElement() and XMLNode::emptyTheNode() in the bundled XML parser (ofstd/libsrc/ofxml.cc) of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaustion and process crash) via a crafted XML document with deeply nested elements. The parser is reachable through dcmencap when encapsulating a CDA document, and through any application that calls OFXMLParser::parseFile() or OFXMLParser::parseString() on untrusted input. The issue is fixed in commit d12e350e687530eb41e2b0c860aff4d8c04e5941.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-44033 dcmtk: dcmtk: Denial of Service via deeply nested XML elements [fedora-all]
bugzilla·2026-10-08·CVSS 5.5
CVE-2026-44033 [MEDIUM] CVE-2026-44033 dcmtk: dcmtk: Denial of Service via deeply nested XML elements [fedora-all]
CVE-2026-44033 dcmtk: dcmtk: Denial of Service via deeply nested XML elements [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Uncontrolled recursion in XMLNode::ParseXMLElement() and XMLNode::emptyTheNode() in the bundled XML parser (ofstd/libsrc/ofxml.cc) of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaustion and process crash) via a crafted XML document with deeply nested elements. The parser is reachable through dcmencap when encapsulating a CDA document, and through any application that calls OFXMLParser::parseFile() or OFXMLParser::parseString() on untrusted input.
Bugzilla
CVE-2026-44033 dcmtk: dcmtk: Denial of Service via deeply nested XML elements
bugzilla·2026-10-08·CVSS 5.5
CVE-2026-44033 [MEDIUM] CVE-2026-44033 dcmtk: dcmtk: Denial of Service via deeply nested XML elements
CVE-2026-44033 dcmtk: dcmtk: Denial of Service via deeply nested XML elements
Uncontrolled recursion in XMLNode::ParseXMLElement() and XMLNode::emptyTheNode() in the bundled XML parser (ofstd/libsrc/ofxml.cc) of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaustion and process crash) via a crafted XML document with deeply nested elements. The parser is reachable through dcmencap when encapsulating a CDA document, and through any application that calls OFXMLParser::parseFile() or OFXMLParser::parseString() on untrusted input. The issue is fixed in commit d12e350e687530eb41e2b0c860aff4d8c04e5941.
Bugzilla
CVE-2026-44033 dcmtk: dcmtk: Denial of Service via deeply nested XML elements [epel-all]
bugzilla·2026-10-08·CVSS 5.5
CVE-2026-44033 [MEDIUM] CVE-2026-44033 dcmtk: dcmtk: Denial of Service via deeply nested XML elements [epel-all]
CVE-2026-44033 dcmtk: dcmtk: Denial of Service via deeply nested XML elements [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Uncontrolled recursion in XMLNode::ParseXMLElement() and XMLNode::emptyTheNode() in the bundled XML parser (ofstd/libsrc/ofxml.cc) of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaustion and process crash) via a crafted XML document with deeply nested elements. The parser is reachable through dcmencap when encapsulating a CDA document, and through any application that calls OFXMLParser::parseFile() or OFXMLParser::parseString() on untrusted input. Th
2026-10-08
Published