This vulnerability (CVE-2026-5440) involves the Orthanc DICOM Server allocating memory directly according to the attacker-supplied Content-Length HTTP header without enforcing any upper limit. This lack of throttling or limits on resource allocation (CWE-770) can lead to memory exhaustion and server termination when processing maliciously crafted HTTP requests. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity due to network attack vector, no privileges required, no user interaction, and impact limited to availability (denial of service). The vendor advisory from CERT does not specify any patch or mitigation status.

The vulnerability allows an unauthenticated remote attacker to cause a denial of service by exhausting server memory resources, resulting in server termination. There is no impact on confidentiality or integrity reported. This can disrupt availability of the Orthanc DICOM Server, affecting dependent medical imaging workflows.

Patch status is not yet confirmed — check the vendor advisory at https://kb.cert.org/vuls/id/536588 for current remediation guidance. Until an official fix is available, consider implementing network-level protections such as limiting request sizes or employing web application firewalls to detect and block suspiciously large Content-Length headers. Monitor for updates from the Orthanc project or CERT advisory for official patches or mitigations.