CVE-2026-5438: 
NixOS vulnerability analysis and mitigation

CVE-2026-5438 is a gzip decompression bomb vulnerability in Orthanc DICOM Server that allows unauthenticated remote attackers to exhaust server memory via a specially crafted HTTP request. The vulnerability affects all Orthanc versions prior to 1.12.11 and was publicly disclosed on April 9, 2026, as part of a broader set of nine vulnerabilities (VU#536588) discovered by Dr. Simon Weber and Volker Schönefeld of Machine Spirits UG. It carries a CVSS v3.1 base score of 7.5 (High) (CERT/CC Advisory, Github Advisory).

The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling): when Orthanc receives an HTTP request with the Content-Encoding: gzip header, it decompresses the body without enforcing any upper bound on the resulting decompressed size. Memory is allocated based on attacker-controlled metadata embedded in the gzip stream (e.g., the ISIZE field), enabling an attacker to craft a small compressed payload that expands to an arbitrarily large decompressed size. No authentication, special privileges, or user interaction is required — any network-accessible Orthanc instance is exploitable. The specific advisory from the researchers is documented at https://www.machinespirits.com/advisory/faca4b/ (CERT/CC Advisory).

Successful exploitation causes excessive memory allocation that exhausts system memory, leading to process termination and denial of service (DoS) of the Orthanc DICOM server. Because Orthanc is widely deployed in healthcare environments to store and process medical imaging data, an outage can disrupt clinical workflows and access to patient imaging records. There is no confidentiality or integrity impact — the vulnerability is purely an availability issue — but the DoS can be triggered reliably with a small, crafted payload (CERT/CC Advisory, Github Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of active in-the-wild exploitation as of the time of disclosure (Feedly). The EPSS score is approximately 0.017% (19th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the attack requires no authentication and no user interaction, making it trivially exploitable by any attacker with network access to the Orthanc HTTP interface (Github Advisory).

1. Reconnaissance: Identify internet-facing or network-accessible Orthanc DICOM server instances (default HTTP port 8042) using tools like Shodan, Censys, or network scanning. Confirm the version is prior to 1.12.11.
2. Craft the decompression bomb: Create a gzip-compressed payload where the ISIZE metadata field (or equivalent compression metadata) advertises a very large decompressed size (e.g., several gigabytes), while the actual compressed data is minimal.
3. Send the malicious HTTP request: Transmit an HTTP POST (or other accepted method) request to any Orthanc endpoint that accepts a body, including the Content-Encoding: gzip header and the crafted payload as the body. No authentication credentials are required.
4. Trigger memory exhaustion: Orthanc decompresses the payload without enforcing size limits, allocating memory based on the attacker-controlled metadata. System memory is exhausted, causing the Orthanc process to terminate and resulting in denial of service (CERT/CC Advisory).

• Network: Unusual HTTP POST requests to Orthanc endpoints (e.g., port 8042) with Content-Encoding: gzip headers from unexpected or external source IPs; small request body sizes paired with abnormally large memory consumption on the server.
• Logs: Orthanc access logs showing requests with Content-Encoding: gzip immediately preceding server crashes or OOM (out-of-memory) events; operating system logs (e.g., /var/log/syslog, dmesg) recording OOM killer events targeting the Orthanc process.
• Process/System: Sudden spike in memory usage by the Orthanc process followed by process termination; repeated Orthanc service restarts in a short time window as recorded by the service manager (e.g., systemd journal).

Orthanc has released version 1.12.11 to address CVE-2026-5438 and all related vulnerabilities; upgrading immediately is the primary recommended remediation (CERT/CC Advisory). Until patching is possible, administrators should implement network-level controls such as enforcing maximum request body size limits on any reverse proxy or WAF in front of Orthanc, rate-limiting compressed HTTP requests, and restricting access to the Orthanc HTTP interface to trusted networks or authenticated users only. Continuous resource monitoring for abnormal memory consumption patterns can help detect exploitation attempts early.

The CERT/CC published vulnerability note VU#536588 on April 9, 2026, covering all nine Orthanc vulnerabilities including CVE-2026-5438, and credited the researchers Dr. Simon Weber and Volker Schönefeld of Machine Spirits UG for responsible disclosure (CERT/CC Advisory). Security news outlets including Security Online and News4Hackers covered the broader set of Orthanc DICOM vulnerabilities, highlighting the healthcare sector risk (Security Online). Rescana and BeyondMachines also published analyses emphasizing the potential impact on healthcare systems (Rescana).