CVE-2026-44031: CWE-674 Uncontrolled Recursion in OFFIS DCMTK

The vulnerability arises from uncontrolled recursion in the DcmSequenceOfItems::read() and DcmItem::read() functions within the dcmdata library of OFFIS DCMTK version 3.7.0. An attacker can exploit this by sending a DICOM dataset containing deeply nested SQ elements in a C-STORE request to various DCMTK-based DICOM services. Because the dataset is parsed before authentication, this leads to stack exhaustion and process crashes, causing denial of service. The flaw also affects local tools that open such files. The fix, implemented in commit 885ff0f10372bd589b5f44cea974f28a3964cb0f, introduces a configurable limit on sequence nesting depth with a default of 64.

A remote, unauthenticated attacker can cause denial of service on DCMTK-based DICOM services and local tools by sending or opening DICOM datasets with deeply nested sequences. This results in stack exhaustion and process crashes, disrupting service availability.

A fix is available and has been committed to the DCMTK codebase, which adds a configurable sequence nesting depth limit (default 64) to prevent uncontrolled recursion. Users should update to the fixed version incorporating this commit. No additional mitigation is required if the fix is applied.