Memory Exhaustion Vulnerability in Orthanc by Machine Spirits

CVE-2026-5438

What is CVE-2026-5438?

A memory exhaustion vulnerability exists in Orthanc when processing HTTP requests that utilize the 'Content-Encoding: gzip' header. The server currently lacks proper limitations on the size of decompressed data, which enables attackers to exploit the compression metadata of specially crafted gzip payloads. This can lead to excessive memory allocation, causing the server to exhaust system memory resources and potentially disrupt services.

References