CVE-2026-5440 — Memory Exhaustion via Unbounded Content-Length

Description (CNA)

A memory exhaustion vulnerability exists in the HTTP server due to unbounded use of the `Content-Length` header. The server allocates memory directly based on the attacker supplied header value without enforcing an upper limit. A crafted HTTP request containing an extremely large `Content-Length` value can trigger excessive memory allocation and server termination, even without sending a request body.

Affected (CNA)

Vendor / product	Versions
Orthanc / DICOM Server	affected 0 through 1.12.10

CWE

No CWE identifiers supplied.

References

https://www.orthanc-server.com/
https://www.machinespirits.de/
https://kb.cert.org/vuls/id/536588

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.