Medium
Security advisory
Uncontrolled recursion in XMLNode::ParseXMLElement() and XMLNode::emptyTheNode() in the bundled XML parser (ofstd/libsrc/ofxml.cc) of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaustion and process crash) via a crafted XML document with deeply nested elements. The parser is reachable through dcmencap when encapsulating a CDA document, and through any application that calls OFXMLParser::parseFile() or OFXMLParser::parseString() on untrusted input. The issue is fixed in commit d12e350e687530eb41e2b0c860aff4d8c04e5941.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-44033
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 13:03 UTC · Revision 1
Source evidence
Uncontrolled recursion in XMLNode::ParseXMLElement() and XMLNode::emptyTheNode() in the bundled XML parser (ofstd/libsrc/ofxml.cc) of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaustion and process crash) via a crafted XML document with deeply nested elements. The parser is reachable through dcmencap when encapsulating a CDA document, and through any application that calls OFXMLParser::parseFile() or OFXMLParser::parseString() on untrusted input. The issue is fixed in commit d12e350e687530eb41e2b0c860aff4d8c04e5941.
osv:CVE-2026-44033
Complete source record
{
"id": "7b396362d3faf9210154c856d68004067c25e7d169960a40204556b0fd6ee14e",
"url": "https://osv.dev/vulnerability/CVE-2026-44033",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2026-44033",
"summary": "Uncontrolled recursion in XMLNode::ParseXMLElement() and XMLNode::emptyTheNode() in the bundled XML parser (ofstd/libsrc/ofxml.cc) of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaustion and process crash) via a crafted XML document with deeply nested elements. The parser is reachable through dcmencap when encapsulating a CDA document, and through any application that calls OFXMLParser::parseFile() or OFXMLParser::parseString() on untrusted input. The issue is fixed in commit d12e350e687530eb41e2b0c860aff4d8c04e5941.",
"evidence": "osv:CVE-2026-44033",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2026-44033",
"aliases": [
"CVE-2026-44033"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/dcmtk/dcmtk",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "d12e350e687530eb41e2b0c860aff4d8c04e5941"
},
{
"last_affected": "d12e350e687530eb41e2b0c860aff4d8c04e5941"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "d12e350e687530eb41e2b0c860aff4d8c04e5941"
}
],
"source": "DESCRIPTION"
},
{
"range": [
{
"introduced": "0"
},
{
"last_affected": "d12e350e687530eb41e2b0c860aff4d8c04e5941"
}
],
"source": "DESCRIPTION"
},
{
"range": [
{
"fixed": "d12e350e687530eb41e2b0c860aff4d8c04e5941"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"latest",
"DCMTK-3.7.0",
"DCMTK-3.6.9",
"DCMTK-3.6.8",
"DCMTK-3.6.7",
"DCMTK-3.6.5",
"DCMTK-3.6.6",
"DCMTK-3.6.5+_20191213",
"DCMTK-3.6.4",
"DCMTK-3.6.3",
"DCMTK-3.6.2",
"DCMTK-3.6.1_20170228",
"DCMTK-3.6.1_20161102",
"DCMTK-3.6.1_20160630",
"DCMTK-3.6.1_20160216",
"DCMTK-3.6.1_20150924",
"DCMTK-3.6.1_20150629",
"DCMTK-3.6.1_20150217",
"DCMTK-3.6.1_20140617",
"DCMTK-3.6.1_20131114",
"DCMTK-3.6.1_20121102",
"DCMTK-3.6.1_20120831",
"DCMTK-3.6.1_20120515",
"DCMTK-3.6.1_20120222",
"DCMTK-3.6.1_20111208",
"DCMTK-3.6.1_20110922",
"DCMTK-3.6.1_20110707",
"DCMTK-3.6.1_20110519",
"DCMTK-3.6.1_20110225",
"DCMTK-3.6.0",
"DCMTK-3.5.4",
"DCMTK-3.5.3",
"DCMTK-3.5.2a",
"DCMTK-3.5.2",
"DCMTK-3.5.1",
"DCMTK-3.5.0",
"DCMTK-3.4.2",
"DCMTK-3.4.1",
"DCMTK-3.4.0",
"DCMTK-3.3.1",
"DCMTK-3.3.0",
"DCMTK-3.2.1",
"DCMTK-3.2.0",
"DCMTK-3.1.2",
"DCMTK-3.1.1",
"DCMTK-3.1.0",
"CAR96-3.0.2",
"CAR96-3.0.1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44033.json",
"vanir_signatures": [
{
"id": "CVE-2026-44033-1ae30ad3",
"digest": {
"length": 5166,
"function_hash": "273064793590780333490402872314950753469"
},
"source": "https://github.com/dcmtk/dcmtk/commit/d12e350e687530eb41e2b0c860aff4d8c04e5941",
"target": {
"file": "ofstd/libsrc/ofxml.cc",
"function": "XMLNode::ParseXMLElement"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2026-44033-21723dd6",
"digest": {
"threshold": 0.9,
"line_hashes": [
"120424057595109747157020487388493811927",
"96866522703757414538719377823868334516",
"235937649455399215090573105420808827370",
"297797722230679246297287068583497491559",
"170413518604887921802846968620570901189",
"252031083353727882279527770435383423652",
"282967483847703224629697395475493131391",
"10144250123956314794591653103527672623",
"130970036434669852056523464522133914902",
"205436454243759327128002872438028069019",
"306309611673135049555245415732485150887",
"183474959394183625677603537551427571609",
"252766733665709575358535515459853509640",
"24868714223192333539765545345009538164",
"272358197928790640520944874006995150505",
"259079798642667506065855235807442184155",
"268422405527428173466227688723296344179",
"49774667107722301184792153273114467881",
"290224579607758226581799954707217143385",
"281719063058040211063612882414822201953",
"293388817368841649348381610581939270420",
"182720413935423225501175078001830120216",
"168120449374764090408695570840128094411",
"157353239438560866541731506786404439069",
"95569140065029953163591475140069202191",
"150063103051838592992334247199704043369",
"84251108428566341183197718557469772343",
"299214092851999206026363632977062644651",
"318290543427725973081553386909215741670",
"190023162867304020860343491372211654898",
"230420704759401822252802091505509835068",
"163613591389324556041105025849108965092",
"160152016565133983931493167049330955648",
"259456286981238922235805754456458744227",
"80573784112490819369913490124196503759",
"237912059873392811694042581902950973245",
"254184799239351754989672389866164280629",
"105974941192396294200235938602635864340",
"192014760700465594902727672295009262605"
]
},
"source": "https://github.com/dcmtk/dcmtk/commit/d12e350e687530eb41e2b0c860aff4d8c04e5941",
"target": {
"file": "ofstd/libsrc/ofxml.cc"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2026-44033-3a3c44c4",
"digest": {
"length": 180,
"function_hash": "15741948462381523450400642678324439971"
},
"source": "https://github.com/dcmtk/dcmtk/commit/d12e350e687530eb41e2b0c860aff4d8c04e5941",
"target": {
"file": "ofstd/libsrc/ofxml.cc",
"function": "operator="
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2026-44033-4e63ba5b",
"digest": {
"length": 1326,
"function_hash": "35541841611799773879740104976521469633"
},
"source": "https://github.com/dcmtk/dcmtk/commit/d12e350e687530eb41e2b0c860aff4d8c04e5941",
"target": {
"file": "ofstd/libsrc/ofxml.cc",
"function": "XMLNode::emptyTheNode"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2026-44033-521732ce",
"digest": {
"threshold": 0.9,
"line_hashes": [
"246127718439257322486335530527517011542",
"47631257766089677813354128536263380344",
"122458075724312792436717533784745260472",
"290590380965323960554728879398209873097",
"840302359633510599445386714322718965",
"324625307373604172619219041705268349009",
"272856057258582445370370911199686379897",
"186691173501867741268892581116441889462",
"247713017610480834120625868133419486971",
"236159428761565498848195223085445400454",
"166503382249423421014381543299404254448",
"201905517865175496167786962915189598332",
"266060468413468181664361662121837972077",
"31667585805837436978784633530018419751"
]
},
"source": "https://github.com/dcmtk/dcmtk/commit/d12e350e687530eb41e2b0c860aff4d8c04e5941",
"target": {
"file": "ofstd/include/dcmtk/ofstd/ofxml.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2026-44033-7dd82618",
"digest": {
"length": 84,
"function_hash": "138833362891902561785941647873303545977"
},
"source": "https://github.com/dcmtk/dcmtk/commit/d12e350e687530eb41e2b0c860aff4d8c04e5941",
"target": {
"file": "ofstd/libsrc/ofxml.cc",
"function": "XMLNode::~XMLNode"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2026-44033-c8510420",
"digest": {
"length": 1211,
"function_hash": "283180224341232576503137373091571119079"
},
"source": "https://github.com/dcmtk/dcmtk/commit/d12e350e687530eb41e2b0c860aff4d8c04e5941",
"target": {
"file": "ofstd/libsrc/ofxml.cc",
"function": "XMLNode::parseString"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2026-44033-cc51651b",
"digest": {
"length": 2039,
"function_hash": "218499052854263540938591394305293135590"
},
"source": "https://github.com/dcmtk/dcmtk/commit/d12e350e687530eb41e2b0c860aff4d8c04e5941",
"target": {
"file": "ofstd/libsrc/ofxml.cc",
"function": "XMLNode::getError"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2026-44033-df585b1c",
"digest": {
"length": 162,
"function_hash": "179324437865223346539410495139617904933"
},
"source": "https://github.com/dcmtk/dcmtk/commit/d12e350e687530eb41e2b0c860aff4d8c04e5941",
"target": {
"file": "ofstd/libsrc/ofxml.cc",
"function": "XMLNode::deleteNodeContent"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T17:21:12Z"
}
}
],
"modified": "2026-10-20T17:21:12.187419907Z",
"provider": "osv",
"references": [
"https://support.dcmtk.org/redmine/issues/1214",
"https://github.com/DCMTK/dcmtk/commit/d12e350e687530eb41e2b0c860aff4d8c04e5941"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2026-44033",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 389776,
"published_at": "2026-10-08T13:17:17.197+00:00"
}