This vulnerability (CVE-2026-35505) in the OFFIS DICOM DCMTK Toolkit involves a missing release of memory after its effective lifetime (CWE-401). An unauthenticated remote attacker can repeatedly send specially crafted connection requests that cause the service to leak memory. In single-process deployments, the memory consumption grows continuously until the service is terminated and the port becomes unresponsive until the service is restarted. The CVSS 4.0 score is 8.7 (high severity) with attack vector network, low attack complexity, no privileges or user interaction required, and high impact on availability. No patch or official remediation is currently documented, and no known exploits are reported in the wild.

The vulnerability allows an unauthenticated remote attacker to cause a denial of service by exhausting memory resources through repeated crafted connection requests. This leads to the service process being killed or becoming unresponsive, resulting in downtime until manual restart. The impact is high on service availability but does not affect confidentiality or integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider deploying the DCMTK Toolkit in multi-process or containerized environments to limit the impact of memory exhaustion. Monitor service health and implement automated restarts to reduce downtime. Avoid exposing the vulnerable service to untrusted networks if possible.