CVE-2026-105667 J4Care dcm4che Missing Authentication for Critical Function

In the default configuration, the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending application. A remote sender can reassign studies and related workflow records from one patient identity to another. The archive's unmerge does not reverse this...

CVE-2026-105667

The J4Care dcm4che system contains a vulnerability where the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending application in the default configuration. This lack of authentication allows a remote sender to reassign studies and related workflow records from on...

CVE-2026-105279

The J4Care dcm4che archive is vulnerable to a missing authentication flaw (CWE-306) in its default configuration. The system incorrectly accepts DICOM associations from unregistered calling AEs, allowing a remote peer to perform unauthorized actions. Specifically, an attacker can use C-FIND and C...

CVE-2026-105279 J4Care dcm4che Missing Authentication for Critical Function

In the default configuration, the archive accepts DICOM associations from an unregistered calling AE. A remote peer can use C-FIND and C-GET to enumerate and retrieve patient information and medical images. It can also use C-STORE to file fabricated study content under an existing patient identit...

CVE-2026-101021 J4Care dcm4che Inefficient Algorithmic Complexity

MultipartInputStream performs inefficient boundary matching and unnecessary buffer copying. Crafted multipart input can force excessive boundary comparisons and repeated copying...

CVE-2026-101021

The J4Care dcm4che software is vulnerable to an Inefficient Algorithmic Complexity flaw (CWE-407) within the MultipartInputStream component. The root cause is that the component performs inefficient boundary matching and unnecessary buffer copying. An attacker can provide crafted multipart input ...

CVE-2026-105273

The J4Care dcm4che software contains a vulnerability where the MP4Parser fails to adequately validate MP4 box sizes . A malformed box can cause the parser to make no forward progress, resulting in a loop with an unreachable exit condition (CWE-835). This flaw can lead to high availability impact ...

CVE-2026-107621

The J4Care dcm4che software is vulnerable to a Loop with Unreachable Exit Condition (CWE-835) within the JPEGParser component. An attacker can trigger an infinite loop by providing a specially crafted or truncated stream. This vulnerability results in a High impact on availability , as it can lea...

CVE-2026-107621 J4Care dcm4che Loop with Unreachable Exit Condition

JPEGParser can enter an infinite loop while parsing a specially crafted or truncated stream...

CVE-2026-97851

The J4Care dcm4che software contains a Missing Authorization vulnerability (CWE-862) within its storage status-change REST service . An attacker can modify location records associated with DICOM instances to a TO_DELETE state. This action triggers the PurgeStorageScheduler to delete the reference...

CVE-2026-97851 J4Care dcm4che Missing Authorization

The storage status-change REST service allows location records still associated with DICOM instances to be changed to deletion-related states. Changing a location to TODELETE causes PurgeStorageScheduler to delete the referenced object from storage even though the corresponding instance record...