Threats tagged 'ghsa-6hp3-vr39-rqw8'

MONAILabel server is vulnerable to a denial-of-service and silent inference corruption attack via crafted DICOM files exploiting pydicom's improper validation of Decimal String (DS) and Integer String (IS) values. An unauthenticated attacker can upload malicious DICOM files containing NaN or infinity values in spatial metadata fields, causing the server to crash or produce corrupted AI inference results. This affects MONAILabel versions prior to 1.6.1 and pydicom versions 0.9.7 through 3.0.2. The vulnerability arises because MONAILabel trusts pydicom output without validating these invalid values, and the REST API accepts uploads without authentication by default. A fix is available in MONAILabel 1.6.1.