CVE-2021-41687

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

DCMTK through 3.6.6 does not handle memory free properly. The program malloc a heap memory for parsing data, but does not free it when error in parsing. Sending specific requests to the dcmqrdb program incur the memory leak. An attacker can use it to launch a DoS attack.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-401

Affected software

No affected versions have been published.

Timeline

Published: Jun 28, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-416887.5DCMTK through 3.6.6 does not handle memory free properly. The object in the program is free but its address is still used in other locations CVE-2021-416897.5DCMTK through 3.6.6 does not handle string copy properly. Sending specific requests to the dcmqrdb program, it would query its database and CVE-2021-41696.1livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-416907.5DCMTK through 3.6.6 does not handle memory free properly. The malloced memory for storing all file information are recorded in a global vari CVE-2021-416919.8A SQL injection vulnerability exists in OS4Ed Open Source Information System Community v8.0 via the "student_id" and "TRANSFER{SCHOOL]" para CVE-2021-416949.8An Incorrect Access Control vulnerability exists in Premiumdatingscript 4.2.7.7 via the password change procedure in requests\user.php.CVE-2021-416959.8An SQL Injection vulnerability exists in Premiumdatingscript 4.2.7.7 via the ip parameter in connect.php. .CVE-2021-416966.5An authentication bypass (account takeover) vulnerability exists in Premiumdatingscript 4.2.7.7 due to a weak password reset mechanism in re CVE-2021-416976.1A reflected Cross Site Scripting (XSS) vulnerability exists in Premiumdatingscript 4.2.7.7 via the aerror_description parameter in assets/so CVE-2021-41705.4calibre-web is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-41719.8calibre-web is vulnerable to Business Logic Errors CVE-2021-417146.5In Tipask < 3.5.9, path parameters entered by the user are not validated when downloading attachments, a registered user can download arbitr