Threat database

CVE-2026-105667 is a vulnerability in J4Care's dcm4chee-arc-light version 5.35.1 where the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sender. This allows a remote attacker to reassign medical studies and workflow records from one patient to another. The archive's unmerge functionality does not reverse this reassignment. The vulnerability has a CVSS score of 7.5, indicating high severity.

CVE-2026-105279 is a critical vulnerability in J4Care's dcm4chee-arc-light version 5.35.1. The default configuration allows the archive to accept DICOM associations from unregistered calling AEs, enabling remote attackers to enumerate and retrieve patient information and medical images via C-FIND and C-GET commands. Additionally, attackers can use C-STORE to file fabricated study content under existing patient identities.

CVE-2026-101021 is a vulnerability in J4Care's dcm4chee-arc-light version 5.35.1 where the MultipartInputStream component performs inefficient boundary matching and unnecessary buffer copying. This flaw allows crafted multipart input to cause excessive boundary comparisons and repeated copying, leading to a high-severity impact on availability.

CVE-2026-105273 is a high severity vulnerability in J4Care's dcm4chee-arc-light version 5.35.1. The issue arises from inadequate validation of MP4 box sizes in the MP4Parser component, which can cause the parser to fail to make forward progress and repeatedly process the same malformed input. This results in a denial of service condition due to resource exhaustion or application hang.

CVE-2026-107621 is a high-severity vulnerability in J4Care's dcm4chee-arc-light version 5.35.1. The JPEGParser component can enter an infinite loop when processing a specially crafted or truncated JPEG stream, leading to a denial of service condition.

CVE-2026-97851 is a critical vulnerability in J4Care's dcm4chee-arc-light version 5.35.1. The issue arises from the storage status-change REST service, which allows location records still linked to DICOM instances to be changed to deletion-related states. Specifically, changing a location to TO_DELETE triggers the PurgeStorageScheduler to delete the referenced object from storage, while the corresponding instance record remains in the database.