Denial of Service Vulnerability in DCMTK Worklist Server
CVE-2026-44628
8.7HIGH
What is CVE-2026-44628?
An unauthenticated attacker can exploit a flaw in the DCMTK Worklist Server to induce a denial of service by sending a specially crafted query. This can result in the server crashing when it possesses a valid Called AE Title, an expected lockfile, and at least one corresponding worklist record, rendering the service unavailable. Timely updates and proper configurations are crucial to mitigate this risk.
Affected Version(s)
DCMTK Toolkit 0 <= 3.7.0
References
CVSS V4
Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Abhinav Agarwal reported this vulnerability to CISA