The Orthanc DICOM Server is vulnerable to a resource exhaustion attack due to improper handling of gzip-compressed HTTP requests. Specifically, the server does not limit the size of decompressed data, leading to uncontrolled memory allocation based on attacker-controlled compression metadata. This vulnerability is classified under CWE-770 (Allocation of Resources Without Limits or Throttling). The absence of decompression size limits can cause the server to consume excessive memory, potentially leading to denial of service conditions.

An attacker can cause the Orthanc DICOM Server to allocate excessive memory by sending a malicious gzip-compressed HTTP request. This can exhaust system memory resources, potentially resulting in denial of service or server instability. There is no indication that this vulnerability allows code execution or data compromise beyond resource exhaustion.

Patch status is not yet confirmed — check the vendor advisory at https://kb.cert.org/vuls/id/536588 for current remediation guidance. Until an official fix is available, consider implementing external protections such as limiting request sizes or deploying network-level controls to detect and block suspicious gzip payloads. Avoid exposing the vulnerable service to untrusted networks where possible.