CVE-2026-101021

J4Care dcm4che Inefficient Algorithmic Complexity

State: Published
Severity: 8.7 High
Published: Oct 16, 2026
Updated: Oct 16, 2026
Reserved: Oct 12, 2026

Description

MultipartInputStream performs inefficient boundary matching and unnecessary buffer copying. Crafted multipart input can force excessive boundary comparisons and repeated copying.

Scores

CVSS	Score	Vector	Source
4.0	8.7 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N	icscert
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	icscert

Weaknesses

CWE-407

Affected Products

Product	Versions
dcm4chee-arc-lightJ4Care	5.35.1Affected 5.35.2Not affected

References

https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-02
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-288-02.json

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.