High
Security advisory
Uncontrolled recursion in DcmSequenceOfItems::read() and DcmItem::read() in the dcmdata library of OFFIS DCMTK 3.7.0 allows a remote, unauthenticated attacker to cause a denial of service (stack exhaustion and process crash) via a DICOM dataset containing deeply nested sequences (SQ elements). The dataset can be sent in a C-STORE request to storescp, dcmrecv, dcmqrscp, or any other DICOM service built on DCMTK, because the received dataset is parsed before any authentication takes place. Local tools such as dcmdump also crash when opening such a file. The issue is fixed in commit 885ff0f10372bd589b5f44cea974f28a3964cb0f, which adds a configurable sequence nesting depth limit (default 64).
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-44031
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 13:04 UTC · Revision 1
Source evidence
Uncontrolled recursion in DcmSequenceOfItems::read() and DcmItem::read() in the dcmdata library of OFFIS DCMTK 3.7.0 allows a remote, unauthenticated attacker to cause a denial of service (stack exhaustion and process crash) via a DICOM dataset containing deeply nested sequences (SQ elements). The dataset can be sent in a C-STORE request to storescp, dcmrecv, dcmqrscp, or any other DICOM service built on DCMTK, because the received dataset is parsed before any authentication takes place. Local tools such as dcmdump also crash when opening such a file. The issue is fixed in commit 885ff0f10372bd589b5f44cea974f28a3964cb0f, which adds a configurable sequence nesting depth limit (default 64).
osv:CVE-2026-44031
Complete source record
{
"id": "de6293acc7caf9b3ae30ed02a7554da1e8285cb8540cb9e606e23bbaafd34d1e",
"url": "https://osv.dev/vulnerability/CVE-2026-44031",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2026-44031",
"summary": "Uncontrolled recursion in DcmSequenceOfItems::read() and DcmItem::read() in the dcmdata library of OFFIS DCMTK 3.7.0 allows a remote, unauthenticated attacker to cause a denial of service (stack exhaustion and process crash) via a DICOM dataset containing deeply nested sequences (SQ elements). The dataset can be sent in a C-STORE request to storescp, dcmrecv, dcmqrscp, or any other DICOM service built on DCMTK, because the received dataset is parsed before any authentication takes place. Local tools such as dcmdump also crash when opening such a file. The issue is fixed in commit 885ff0f10372bd589b5f44cea974f28a3964cb0f, which adds a configurable sequence nesting depth limit (default 64).",
"evidence": "osv:CVE-2026-44031",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2026-44031",
"aliases": [
"CVE-2026-44031"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/dcmtk/dcmtk",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "885ff0f10372bd589b5f44cea974f28a3964cb0f"
},
{
"last_affected": "885ff0f10372bd589b5f44cea974f28a3964cb0f"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "885ff0f10372bd589b5f44cea974f28a3964cb0f"
}
],
"source": "DESCRIPTION"
},
{
"range": [
{
"introduced": "0"
},
{
"last_affected": "885ff0f10372bd589b5f44cea974f28a3964cb0f"
}
],
"source": "DESCRIPTION"
},
{
"range": [
{
"fixed": "885ff0f10372bd589b5f44cea974f28a3964cb0f"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"latest",
"DCMTK-3.7.0",
"DCMTK-3.6.9",
"DCMTK-3.6.8",
"DCMTK-3.6.7",
"DCMTK-3.6.5",
"DCMTK-3.6.6",
"DCMTK-3.6.5+_20191213",
"DCMTK-3.6.4",
"DCMTK-3.6.3",
"DCMTK-3.6.2",
"DCMTK-3.6.1_20170228",
"DCMTK-3.6.1_20161102",
"DCMTK-3.6.1_20160630",
"DCMTK-3.6.1_20160216",
"DCMTK-3.6.1_20150924",
"DCMTK-3.6.1_20150629",
"DCMTK-3.6.1_20150217",
"DCMTK-3.6.1_20140617",
"DCMTK-3.6.1_20131114",
"DCMTK-3.6.1_20121102",
"DCMTK-3.6.1_20120831",
"DCMTK-3.6.1_20120515",
"DCMTK-3.6.1_20120222",
"DCMTK-3.6.1_20111208",
"DCMTK-3.6.1_20110922",
"DCMTK-3.6.1_20110707",
"DCMTK-3.6.1_20110519",
"DCMTK-3.6.1_20110225",
"DCMTK-3.6.0",
"DCMTK-3.5.4",
"DCMTK-3.5.3",
"DCMTK-3.5.2a",
"DCMTK-3.5.2",
"DCMTK-3.5.1",
"DCMTK-3.5.0",
"DCMTK-3.4.2",
"DCMTK-3.4.1",
"DCMTK-3.4.0",
"DCMTK-3.3.1",
"DCMTK-3.3.0",
"DCMTK-3.2.1",
"DCMTK-3.2.0",
"DCMTK-3.1.2",
"DCMTK-3.1.1",
"DCMTK-3.1.0",
"CAR96-3.0.2",
"CAR96-3.0.1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44031.json",
"vanir_signatures": [
{
"id": "CVE-2026-44031-02c9ead1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"88238609364975692370548715268803991392",
"249051495464410521141528724360074006635",
"80913883576157266836551071974461118050",
"247776402161534125448178064749433515566",
"64025567020696321334010664245492350555"
]
},
"source": "https://github.com/dcmtk/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f",
"target": {
"file": "dcmdata/include/dcmtk/dcmdata/dcitem.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2026-44031-12a08936",
"digest": {
"threshold": 0.9,
"line_hashes": [
"236793011814673072250313060372610324076",
"167273616018612628298392957591921496401",
"92953127950849032365926128279559100332",
"49938571361326320797406960459210434524",
"236793011814673072250313060372610324076",
"167273616018612628298392957591921496401",
"92953127950849032365926128279559100332",
"49938571361326320797406960459210434524",
"264476321074613017467641509870843195196",
"201070500451849921611226041374723666196",
"239990100744491323181233019124813777789",
"122942970089730562164959843432277948049",
"339164428870443468996019408557426701392",
"166583233230805909861902440878618772217",
"36211575586771925758894545045106125041",
"256128107525997606043894360587975449422",
"131339062499029587804923668237481521524",
"72972829367696715929652742071031105460",
"14429616908889564713223168017804378321"
]
},
"source": "https://github.com/dcmtk/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f",
"target": {
"file": "dcmdata/libsrc/dcitem.cc"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2026-44031-156cda03",
"digest": {
"threshold": 0.9,
"line_hashes": [
"162141217453372074662524841860662121760",
"312983999675835927335631713451518861303",
"284156689694739488069747013954669075364",
"233761324063025911253933183816001492115",
"162141217453372074662524841860662121760",
"312983999675835927335631713451518861303",
"284156689694739488069747013954669075364",
"181487418675805684842645679893608688741",
"54942413307623317152432788846733028103",
"152191121987512408022991540519585280793",
"113718685876369151428690681447398556567",
"240634145469104518616599068568715122080",
"242974284623604487922156026266877937521",
"120678701995436905852525364458285958767",
"221872257673316964622898017082269673311",
"116256373462186955413971350621644430463",
"38682780172975141478406498574505791518",
"104055884051393632977001508667117132646",
"65026636725919931122362468823437352632",
"155838377165578441582482896513761138966",
"80279465662043972783156442705704128406",
"232578465617334918291694887699240394667",
"200531233902356942971541402895023439614",
"173924152460020242762038832061205440589"
]
},
"source": "https://github.com/dcmtk/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f",
"target": {
"file": "dcmdata/libsrc/dcfilefo.cc"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2026-44031-2993eab1",
"digest": {
"length": 782,
"function_hash": "330185888656851417666340724066308112911"
},
"source": "https://github.com/dcmtk/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f",
"target": {
"file": "dcmnet/libsrc/scu.cc",
"function": "DcmSCU::DcmSCU"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2026-44031-39cf770f",
"digest": {
"threshold": 0.9,
"line_hashes": [
"38682780172975141478406498574505791518",
"104055884051393632977001508667117132646",
"65026636725919931122362468823437352632",
"155838377165578441582482896513761138966",
"52834501376266510113523220332208945232",
"232578465617334918291694887699240394667",
"200531233902356942971541402895023439614",
"173924152460020242762038832061205440589"
]
},
"source": "https://github.com/dcmtk/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f",
"target": {
"file": "dcmdata/libsrc/dcdatset.cc"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2026-44031-3f65a858",
"digest": {
"length": 698,
"function_hash": "228842641482655240605021571467789595780"
},
"source": "https://github.com/dcmtk/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f",
"target": {
"file": "dcmdata/libsrc/dcdatset.cc",
"function": "DcmDataset::loadFileUntilTag"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2026-44031-41f4d695",
"digest": {
"threshold": 0.9,
"line_hashes": [
"113836015843579195615214672981085779838",
"171278011314473467103141805276229486004",
"174429017689594655616917902558513442622",
"97851517480019424554202101913749178794",
"71917939634695301329125276289393168206"
]
},
"source": "https://github.com/dcmtk/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f",
"target": {
"file": "dcmdata/include/dcmtk/dcmdata/dcerror.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2026-44031-4352b4dc",
"digest": {
"length": 3482,
"function_hash": "27803570932123978523075275249098196133"
},
"source": "https://github.com/dcmtk/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f",
"target": {
"file": "dcmdata/libsrc/dcitem.cc",
"function": "DcmItem::readUntilTag"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2026-44031-4921f701",
"digest": {
"length": 464,
"function_hash": "308240186784173488803296395121188876472"
},
"source": "https://github.com/dcmtk/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f",
"target": {
"file": "dcmdata/libsrc/dcfilefo.cc",
"function": "DcmFileFormat::DcmFileFormat"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2026-44031-4e5a3404",
"digest": {
"threshold": 0.9,
"line_hashes": [
"259140037747176194524390387539822548179",
"56875555695671198495638737173370478394",
"322177048483761437119505563724341432062"
]
},
"source": "https://github.com/dcmtk/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f",
"target": {
"file": "dcmdata/include/dcmtk/dcmdata/dcfilefo.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2026-44031-5e8a80e2",
"digest": {
"length": 720,
"function_hash": "103137516347920301524087873940512342220"
},
"source": "https://github.com/dcmtk/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f",
"target": {
"file": "dcmnet/libsrc/scu.cc",
"function": "DcmSCU::receiveDIMSEDataset"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2026-44031-61a07bcd",
"digest": {
"length": 987,
"function_hash": "248140613660407942970022067525487864602"
},
"source": "https://github.com/dcmtk/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f",
"target": {
"file": "dcmdata/libsrc/dcfilefo.cc",
"function": "DcmFileFormat::loadFileUntilTag"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2026-44031-67ee5fba",
"digest": {
"length": 193,
"function_hash": "233385292454786740117323451658826855877"
},
"source": "https://github.com/dcmtk/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f",
"target": {
"file": "dcmdata/libsrc/dcitem.cc",
"function": "DcmItem::DcmItem"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2026-44031-6af40467",
"digest": {
"threshold": 0.9,
"line_hashes": [
"112002847792759364397706020073552473598",
"130903578905647766071092849106378407669"
]
},
"source": "https://github.com/dcmtk/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f",
"target": {
"file": "dcmnet/tests/tests.cc"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2026-44031-6e203790",
"digest": {
"threshold": 0.9,
"line_hashes": [
"31799629272127582985197796274920677834",
"308783703772647228448750639350430278019",
"9870322893850541779731586590890644758",
"166200380381647034166302528527776315792",
"151944501314997994955567042471672923570",
"291833787216187462388573516767889211041",
"245190644755596963962438245360759405553",
"243879078149459647001891396063028659474",
"302749898592811007501013185262795855783"
]
},
"source": "https://github.com/dcmtk/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f",
"target": {
"file": "dcmdata/libsrc/dcsequen.cc"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2026-44031-80bee9d8",
"digest": {
"length": 572,
"function_hash": "180963592842137496091546307104467661730"
},
"source": "https://github.com/dcmtk/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f",
"target": {
"file": "dcmdata/libsrc/dcitem.cc",
"function": "operator="
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2026-44031-81503b92",
"digest": {
"length": 807,
"function_hash": "301327964717854017840727704077015093662"
},
"source": "https://github.com/dcmtk/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f",
"target": {
"file": "dcmnet/libsrc/scp.cc",
"function": "DcmSCP::receiveDIMSEDataset"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2026-44031-97fdba8a",
"digest": {
"length": 616,
"function_hash": "301480989758005585431683914810969132622"
},
"source": "https://github.com/dcmtk/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f",
"target": {
"file": "dcmdata/libsrc/dcfilefo.cc",
"function": "DcmFileFormat::DcmFileFormat"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2026-44031-a08c4664",
"digest": {
"threshold": 0.9,
"line_hashes": [
"124985748853853802052550445626765209138",
"316598267583678326353730265333456488292",
"335063704624970107783598043262943913552",
"42211384985223797821650828105113001921",
"227578951279942760154284059296137620366",
"161364919761222454056786200740831618177",
"50256042444111234098043631646404398368",
"41964351962433288145414059784303830292",
"216473288266488252539848859549598794121",
"38432020192851730719049554543293069457",
"188906312221643730212861497202638489899",
"980125832670831362428147524796078518",
"287752035077695200161370983161457366345",
"280032135279036693900113744352436130103",
"73994930608049966151332618666183194174",
"320288867634544154383157458153996132775",
"173556958900504212347219724305559188524"
]
},
"source": "https://github.com/dcmtk/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f",
"target": {
"file": "dcmnet/libsrc/scp.cc"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2026-44031-a1cd5700",
"digest": {
"length": 334,
"function_hash": "17521631950675181706209319900625772137"
},
"source": "https://github.com/dcmtk/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f",
"target": {
"file": "dcmdata/libsrc/dcitem.cc",
"function": "privateCreatorCache"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2026-44031-a3f26faf",
"digest": {
"threshold": 0.9,
"line_hashes": [
"78252311383533759621059030838332810677",
"337140346108702399635632392574913295666",
"54873546147047355266362866142321839695",
"163767919242601542440242824020503994841"
]
},
"source": "https://github.com/dcmtk/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f",
"target": {
"file": "dcmdata/include/dcmtk/dcmdata/dcobject.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2026-44031-a5fd72a6",
"digest": {
"length": 255,
"function_hash": "55010672410095245530692997819095081726"
},
"source": "https://github.com/dcmtk/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f",
"target": {
"file": "dcmdata/libsrc/dcfilefo.cc",
"function": "DcmFileFormat::DcmFileFormat"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2026-44031-a65dc1f4",
"digest": {
"threshold": 0.9,
"line_hashes": [
"237909340918838564059743058052338559526",
"337177653907148305082886855542853878808",
"31180389016062869938263020312030244695",
"144946011861936213030268931444908530235",
"61785628002405978260616244959281011615",
"291179905588318541726693095015073892365",
"169741787905745937127017666465406383960",
"111642369821826094138354693338713911789",
"214835867258434630913184719848664407189"
]
},
"source": "https://github.com/dcmtk/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f",
"target": {
"file": "dcmnet/include/dcmtk/dcmnet/scp.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2026-44031-ab6371a1",
"digest": {
"length": 1831,
"function_hash": "42538246107604709154513274339431396466"
},
"source": "https://github.com/dcmtk/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f",
"target": {
"file": "dcmdata/libsrc/dcsequen.cc",
"function": "DcmSequenceOfItems::read"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2026-44031-b82bc86a",
"digest": {
"length": 114,
"function_hash": "65502659688450508930150203597814880103"
},
"source": "https://github.com/dcmtk/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f",
"target": {
"file": "dcmnet/libsrc/scp.cc",
"function": "DcmSCP::DcmSCP"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2026-44031-c67cd988",
"digest": {
"length": 133,
"function_hash": "97935073973557880975019222075842935799"
},
"source": "https://github.com/dcmtk/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f",
"target": {
"file": "dcmdata/libsrc/dcistrma.cc",
"function": "DcmInputStream::DcmInputStream"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2026-44031-cffdfdc5",
"digest": {
"threshold": 0.9,
"line_hashes": [
"42785369464058843538226827521822982746",
"149979370217108428574067471714410735297",
"309860639139384541277428363611799190919"
]
},
"source": "https://github.com/dcmtk/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f",
"target": {
"file": "dcmdata/tests/tests.cc"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2026-44031-d3c71789",
"digest": {
"threshold": 0.9,
"line_hashes": [
"150283283817342917751155989659229137906",
"85556372029583432484320202835922008102",
"63517451048119552980482808952352406",
"58390076699891678351447374080591374634",
"332459884949738184458040250542957908542",
"8647750235805851055550890636317903117",
"50557582904768347768549314073135456022",
"41964351962433288145414059784303830292",
"216473288266488252539848859549598794121",
"38432020192851730719049554543293069457",
"188906312221643730212861497202638489899",
"207108111455038338056225274911545424478",
"275156015571040875717381897144943242230",
"108130103650867421329819724243418011343",
"240191324593329261673513635685010101970",
"167644973932610156037591254215153731665",
"98769666420014548323745987513350827781"
]
},
"source": "https://github.com/dcmtk/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f",
"target": {
"file": "dcmnet/libsrc/scu.cc"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2026-44031-e3be736d",
"digest": {
"threshold": 0.9,
"line_hashes": [
"112390600507386179164736370898939552287",
"298569335724668850162116383970314422625",
"285473771516825404338306124734365393353",
"91296256783143341954373355638639492896",
"294320199627968664310271754135515283261",
"210936298186673595908980413905049666555",
"329442566199833318889089575572600148605",
"256911087501572627219635813886289998607",
"111319153987184749579977857285752617467"
]
},
"source": "https://github.com/dcmtk/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f",
"target": {
"file": "dcmnet/include/dcmtk/dcmnet/scu.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2026-44031-e9bb12f6",
"digest": {
"threshold": 0.9,
"line_hashes": [
"145811959456411228945486535320389804561",
"5775225625182196780520464284226347645",
"117820589054561048756241998886846690152",
"247013485370865122419726383650423042623",
"239877558909252769479273252967789003770",
"205781044058803878311716311298762878226",
"55546952840312055084268794344569922278",
"231310957508496678666202296730626548727"
]
},
"source": "https://github.com/dcmtk/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f",
"target": {
"file": "dcmdata/libsrc/dcistrma.cc"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2026-44031-f0bef74b",
"digest": {
"length": 286,
"function_hash": "115124560523781494795849359294634311842"
},
"source": "https://github.com/dcmtk/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f",
"target": {
"file": "dcmdata/libsrc/dcfilefo.cc",
"function": "operator="
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2026-44031-f6b8d969",
"digest": {
"length": 229,
"function_hash": "205890316368674608282278135265679420572"
},
"source": "https://github.com/dcmtk/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f",
"target": {
"file": "dcmdata/libsrc/dcitem.cc",
"function": "DcmItem::DcmItem"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2026-44031-f85fbd57",
"digest": {
"threshold": 0.9,
"line_hashes": [
"10936062220580133686343854796432399886",
"152132778633404190218114230132115745460",
"204111294850913647163317468787086587878",
"16925144763443591460292917281694457754",
"266423645604197214560886247861516677405",
"162004281120646897414782609198547639951",
"193154211619780310149896225259776850461"
]
},
"source": "https://github.com/dcmtk/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f",
"target": {
"file": "dcmdata/include/dcmtk/dcmdata/dcistrma.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2026-44031-f892ec8b",
"digest": {
"threshold": 0.9,
"line_hashes": [
"231882325236637000693329960198810541899"
]
},
"source": "https://github.com/dcmtk/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f",
"target": {
"file": "dcmnet/tests/tscuscp.cc"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2026-44031-f8a71ad2",
"digest": {
"threshold": 0.9,
"line_hashes": [
"129222959818491042024521865853866630246",
"275137403909641673257985981769683535585",
"329432288339278530081012387994125733009",
"223893529667213587683941794793713101597"
]
},
"source": "https://github.com/dcmtk/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f",
"target": {
"file": "dcmdata/libsrc/dcerror.cc"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T17:21:14Z"
}
}
],
"modified": "2026-10-20T17:21:14.215464298Z",
"provider": "osv",
"references": [
"https://support.dcmtk.org/redmine/issues/1191",
"https://github.com/DCMTK/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2026-44031",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 389780,
"published_at": "2026-10-08T13:17:17.027+00:00"
}