This vulnerability (CVE-2026-5438) in Orthanc DICOM Server arises from the lack of limits or throttling on resource allocation during gzip decompression of HTTP requests. When processing a request with Content-Encoding: gzip, the server allocates memory based on the compression metadata without enforcing size constraints. An attacker can exploit this by sending a specially crafted gzip payload that triggers excessive memory allocation, leading to system memory exhaustion and denial of service. The CVSS score is 7.5, reflecting a high impact on availability with no impact on confidentiality or integrity. No official patch or remediation level has been published, and no exploits are currently known in the wild.

The vulnerability can cause denial of service by exhausting system memory through excessive allocation during gzip decompression. This impacts the availability of the Orthanc DICOM Server but does not affect confidentiality or integrity. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory at https://kb.cert.org/vuls/id/536588 for current remediation guidance. Until an official fix is available, consider implementing external protections such as limiting request sizes or disabling gzip content encoding if feasible. Monitor for updates from the vendor or CERT.