CVE-2026-107621: CWE-835 in J4Care dcm4chee-arc-light

This vulnerability, identified as CWE-835 (Loop with Unreachable Exit Condition), affects the JPEGParser in dcm4chee-arc-light version 5.35.1. When parsing certain malformed or truncated JPEG streams, the parser may enter an infinite loop, causing the application to hang or become unresponsive. The CVSS 3.1 score is 7.5, reflecting a network attack vector with low complexity, no privileges or user interaction required, and an impact limited to availability (denial of service). No confidentiality or integrity impact is noted. There is no indication of known exploits in the wild or vendor-provided patches at this time.

Successful exploitation results in a denial of service by causing the JPEGParser to enter an infinite loop, potentially making the affected application unresponsive. There is no direct impact on confidentiality or integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. In the meantime, consider mitigating exposure by restricting untrusted JPEG input or applying input validation if feasible.