CVE-2026-5440

HighCVSS 7.5/10Last modified Oct 26, 2026

Description

A memory exhaustion vulnerability exists in the HTTP server due to unbounded use of the `Content-Length` header. The server allocates memory directly based on the attacker supplied header value without enforcing an upper limit. A crafted HTTP request containing an extremely large `Content-Length` value can trigger excessive memory allocation and server termination, even without sending a request body.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

Vendor	Product	Versions
Orthanc	DICOM Server	<= 1.12.10

References

https://kb.cert.org/vuls/id/536588Third Party Advisory, VDB Entry
https://www.machinespirits.de/Not Applicable
https://www.orthanc-server.com/Product

Timeline

Published: Apr 9, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-544009.1A malicious actor with access to the network and high privileges could exploit an Improper Access Control vulnerability found in UniFi Acces CVE-2026-544018.8A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) to escalate privileges wi CVE-2026-544028.8A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi OS t CVE-2026-544038.6A malicious actor with access to the network could exploit a Path Traversal vulnerability found in certain devices running UniFi OS to bypas CVE-2026-544048.8A malicious actor with access to the network and low privileges could exploit a series of authenticated SQL Injection vulnerabilities found CVE-2026-544057.5A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Network Application to CVE-2026-544068.7A malicious actor with access to the network and high privileges could exploit a Path Traversal vulnerability found in self-hosted instances CVE-2026-544078.6A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect Application to by CVE-2026-544089.8A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect Application to by CVE-2026-544098.1A malicious actor with access to the network and under certain conditions could exploit an Improper Initialization vulnerability found in Un CVE-2026-54417.1An out-of-bounds read vulnerability exists in the `DecodePsmctRle1` function of `DicomImageDecoder.cpp`. The `PMSCT_RLE1` decompression rout CVE-2026-544108.6nanoMODBUS through v1.23.0 contains an off-by-one buffer overflow in the recv_msg_header function of the Modbus/TCP server that allows remot