CVE-2026-5438 — Vulnetix

CVE-2026-5438 PUBLISHED

A gzip decompression bomb vulnerability exists when Orthanc processes HTTP request with `Content-Encoding: gzip`. The server does not enforce limits on decompressed size and allocates memory based on attacker-controlled compression metadata. A specially crafted gzip payload can trigger excessive memory allocation and exhaust system memory.

EPSS 0.06% · 19.0th percentile

Risk Scores

EPSS Score

0.06%

19.0th percentile

Affected Products

Vendor	Product	Versions
Orthanc	DICOM Server	0

Timeline

Apr 9, 2026 CVE Published
Apr 9, 2026 PoC Published
Apr 9, 2026 Security Advisory
Apr 10, 2026 EPSS Score
Apr 14, 2026 CVE Updated
Apr 16, 2026 Security Advisory
May 18, 2026 EPSS Score
May 19, 2026 EPSS Score
May 20, 2026 EPSS Score
May 21, 2026 EPSS Score
May 22, 2026 EPSS Score
May 23, 2026 EPSS Score

References

https://www.orthanc-server.com/ url
https://www.machinespirits.de/ url
https://kb.cert.org/vuls/id/536588 url
https://nvd.nist.gov/vuln/detail/CVE-2026-5438 advisory
https://www.machinespirits.de url
https://www.orthanc-server.com url

Open in Interactive Console →