Skip to content
Heist/ feed
Back to feed
High

Security advisory

Type: advisorySources: OSVCVE: CVE-2021-41689

DCMTK through 3.6.6 does not handle string copy properly. Sending specific requests to the dcmqrdb program, it would query its database and copy the result even if the result is null, which can incur a head-based overflow. An attacker can use it to launch a DoS attack.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2021-41689
Confirmed fixed CVEs
Not specified
Updated in this feed
31 Oct 2026, 12:53 UTC · Revision 1

Source evidence

CVE-2021-41689

core-osv · Original source

Published 28 Jun 2022, 13:15 UTC

DCMTK through 3.6.6 does not handle string copy properly. Sending specific requests to the dcmqrdb program, it would query its database and copy the result even if the result is null, which can incur a head-based overflow. An attacker can use it to launch a DoS attack.

osv:CVE-2021-41689
Complete source record
{
  "id": "7b2fe6ee84a1e275b862bef720fd2ddf1349f578f19b540791e8da3b7c45b0a3",
  "url": "https://osv.dev/vulnerability/CVE-2021-41689",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "CVE-2021-41689",
    "summary": "DCMTK through 3.6.6 does not handle string copy properly. Sending specific requests to the dcmqrdb program, it would query its database and copy the result even if the result is null, which can incur a head-based overflow. An attacker can use it to launch a DoS attack.",
    "evidence": "osv:CVE-2021-41689",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2021-41689",
      "aliases": [
        "CVE-2021-41689"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/dcmtk/dcmtk",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "last_affected": "6cb30bd7fb42190e0188afbd8cb961c62a6fb9c9"
                },
                {
                  "fixed": "5c14bf53fb42ceca12bbcc0016e8704b1580920d"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:offis:dcmtk:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "last_affected": "3.6.6"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "range": [
                      {
                        "fixed": "5c14bf53fb42ceca12bbcc0016e8704b1580920d"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  }
                ]
              }
            }
          ],
          "versions": [
            "DCMTK-3.6.5",
            "DCMTK-3.6.6",
            "DCMTK-3.6.5+_20191213",
            "DCMTK-3.6.4",
            "DCMTK-3.6.3",
            "DCMTK-3.6.2",
            "DCMTK-3.6.1_20170228",
            "DCMTK-3.6.1_20161102",
            "DCMTK-3.6.1_20160630",
            "DCMTK-3.6.1_20160216",
            "DCMTK-3.6.1_20150924",
            "DCMTK-3.6.1_20150629",
            "DCMTK-3.6.1_20150217",
            "DCMTK-3.6.1_20140617",
            "DCMTK-3.6.1_20131114",
            "DCMTK-3.6.1_20121102",
            "DCMTK-3.6.1_20120831",
            "DCMTK-3.6.1_20120515",
            "DCMTK-3.6.1_20120222",
            "DCMTK-3.6.1_20111208",
            "DCMTK-3.6.1_20110922",
            "DCMTK-3.6.1_20110707",
            "DCMTK-3.6.1_20110519",
            "DCMTK-3.6.1_20110225",
            "DCMTK-3.6.0",
            "DCMTK-3.5.4",
            "DCMTK-3.5.3",
            "DCMTK-3.5.2a",
            "DCMTK-3.5.2",
            "DCMTK-3.5.1",
            "DCMTK-3.5.0",
            "DCMTK-3.4.2",
            "DCMTK-3.4.1",
            "DCMTK-3.4.0",
            "DCMTK-3.3.1",
            "DCMTK-3.3.0",
            "DCMTK-3.2.1",
            "DCMTK-3.2.0",
            "DCMTK-3.1.2",
            "DCMTK-3.1.1",
            "DCMTK-3.1.0",
            "CAR96-3.0.2",
            "CAR96-3.0.1"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-41689.json",
            "vanir_signatures": [
              {
                "id": "CVE-2021-41689-71369e06",
                "digest": {
                  "length": 439,
                  "function_hash": "80136285118307407980788561937282351991"
                },
                "source": "https://github.com/dcmtk/dcmtk/commit/5c14bf53fb42ceca12bbcc0016e8704b1580920d",
                "target": {
                  "file": "dcmnet/libsrc/diutil.cc",
                  "function": "DU_getStringDOElement"
                },
                "deprecated": false,
                "signature_type": "Function",
                "signature_version": "v1"
              },
              {
                "id": "CVE-2021-41689-d8b7fc02",
                "digest": {
                  "threshold": 0.9,
                  "line_hashes": [
                    "271725108542103721447172720779576056066",
                    "316500101137357808368170813884001274287",
                    "305284922305329055125628489147487985880",
                    "104193795071144907342856644040731570808"
                  ]
                },
                "source": "https://github.com/dcmtk/dcmtk/commit/5c14bf53fb42ceca12bbcc0016e8704b1580920d",
                "target": {
                  "file": "dcmnet/libsrc/diutil.cc"
                },
                "deprecated": false,
                "signature_type": "Line",
                "signature_version": "v1"
              }
            ],
            "vanir_signatures_modified": "2026-10-20T14:28:24Z"
          }
        }
      ],
      "modified": "2026-10-20T14:28:24.741594018Z",
      "provider": "osv",
      "references": [
        "https://lists.debian.org/debian-lts-announce/2024/06/msg00022.html",
        "https://lists.debian.org/debian-lts-announce/2025/01/msg00032.html",
        "https://github.com/DCMTK/dcmtk/commit/5c14bf53fb42ceca12bbcc0016e8704b1580920d",
        "https://github.com/DCMTK/dcmtk"
      ],
      "provider_metadata": {}
    },
    "related_cves": [
      {
        "value": "CVE-2021-41689",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 389058,
  "published_at": "2022-06-28T13:15:10.587+00:00"
}