CVE-2026-101021: CWE-407 in J4Care dcm4chee-arc-light

The vulnerability identified as CVE-2026-101021 affects the MultipartInputStream in J4Care's dcm4chee-arc-light version 5.35.1. The component inefficiently matches boundaries and performs unnecessary buffer copying when processing multipart input. An attacker can craft multipart input to trigger excessive boundary comparisons and repeated copying operations, which can degrade system performance or cause denial of service conditions. The CVSS 3.1 base score is 7.5, indicating a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to availability.

This vulnerability can be exploited remotely without authentication or user interaction to cause a denial of service by exhausting resources through inefficient processing of crafted multipart input. There is no impact on confidentiality or integrity, only availability is affected.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider limiting exposure to untrusted multipart input or applying input validation controls if feasible.