CVE-2026-5439: 
NixOS vulnerability analysis and mitigation

CVE-2026-5439 is a memory exhaustion vulnerability in Orthanc DICOM Server's ZIP archive processing component. Orthanc automatically extracts ZIP archives uploaded to certain endpoints and blindly trusts metadata fields describing the uncompressed size of archived files, allowing an attacker to craft a small ZIP archive with a forged size value that causes the server to allocate extremely large memory buffers during extraction. All versions of Orthanc prior to 1.12.11 are affected. The vulnerability was disclosed on April 9, 2026, by Dr. Simon Weber and Volker Schönefeld of Machine Spirits UG, and assigned a CVSS v3.1 base score of 7.5 (High) (CERT/CC Advisory, GitHub Advisory).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling): Orthanc's ZIP extraction logic reads the declared uncompressed size from the ZIP archive's local file header metadata and uses it directly to allocate memory buffers without validating or capping the value. Because this metadata is fully attacker-controlled, a malicious actor can embed an arbitrarily large size value in a tiny, valid ZIP file. The attack is delivered over the network via an HTTP upload to endpoints that trigger automatic ZIP extraction, requiring no authentication or user interaction (CERT/CC Advisory, GitHub Advisory). A detailed vendor advisory for this specific issue is available at the Machine Spirits advisory page (Machine Spirits).

Successful exploitation causes the Orthanc server process to attempt allocating extremely large memory buffers, leading to memory exhaustion, service degradation, and likely process termination — resulting in a denial of service (DoS) condition. Because Orthanc is widely deployed in healthcare environments to store and process medical imaging (DICOM) data, a successful DoS attack could disrupt access to critical patient imaging records. There is no confidentiality or integrity impact associated with this specific vulnerability; the impact is limited to availability (CERT/CC Advisory, GitHub Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability requires no authentication, no special privileges, and no user interaction, making it trivially exploitable by any network-accessible attacker once a target is identified. The EPSS score is approximately 0.017% (0.000170), indicating a low current probability of exploitation in the next 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection coverage exists via Tenable Nessus plugin 305815 (Tenable).

1. Reconnaissance: Identify internet-facing or network-accessible Orthanc DICOM Server instances running version 1.12.10 or earlier using tools like Shodan (searching for Orthanc HTTP API banners) or by probing the default REST API port (typically 8042).
2. Craft malicious ZIP archive: Create a minimal, syntactically valid ZIP archive where the local file header's uncompressed size field is set to an extremely large value (e.g., close to 4 GB or larger), while the actual compressed payload remains tiny (e.g., a few bytes).
3. Identify target upload endpoint: Locate an Orthanc endpoint that accepts ZIP archive uploads and triggers automatic extraction, such as the /instances REST API endpoint used for DICOM instance ingestion.
4. Upload the crafted archive: Send an HTTP POST request with the malicious ZIP file as the request body to the identified endpoint. No authentication credentials are required if the Orthanc instance is configured with default or open access settings.
5. Trigger memory exhaustion: Upon receipt, Orthanc reads the forged uncompressed size from the ZIP metadata and attempts to allocate a correspondingly large memory buffer, exhausting available system memory and causing the server process to crash or become unresponsive, achieving denial of service (CERT/CC Advisory).

• Network: Unusual HTTP POST requests to Orthanc REST API endpoints (e.g., /instances) containing small ZIP files (low Content-Length) from unexpected or external source IPs; repeated upload attempts from the same source in a short timeframe.
• Logs: Orthanc server logs showing memory allocation failures or out-of-memory errors immediately following a ZIP upload request; abrupt process termination entries in system logs (e.g., OOM killer events in /var/log/syslog or dmesg on Linux).
• Process/System: Sudden spike in memory consumption by the Orthanc process visible in system monitoring tools (e.g., top, htop, Task Manager) followed by process crash; system-level OOM (Out of Memory) events correlated with incoming HTTP upload activity.
• File System: Presence of small, anomalous ZIP files in Orthanc's temporary upload or processing directories with disproportionately large declared uncompressed sizes (CERT/CC Advisory).

Orthanc has released version 1.12.11 to address CVE-2026-5439 and all related vulnerabilities in the batch; users are strongly advised to upgrade immediately (CERT/CC Advisory). As interim workarounds, administrators should restrict access to Orthanc upload endpoints (e.g., /instances) to trusted networks or authenticated users only, and consider disabling automatic ZIP extraction if it is not operationally required. Implementing network-level controls such as firewalls or reverse proxies to limit who can reach the Orthanc HTTP API will reduce the attack surface until patching is complete.

The CERT/CC published vulnerability note VU#536588 on April 9, 2026, covering CVE-2026-5439 alongside eight other vulnerabilities in Orthanc, and credited Dr. Simon Weber and Volker Schönefeld of Machine Spirits UG for responsible disclosure (CERT/CC Advisory). Orthanc's vendor confirmed the vulnerability and committed to patching in version 1.12.11. Security news outlets including News4Hackers and Rescana covered the broader set of Orthanc vulnerabilities, highlighting the healthcare sector risk given Orthanc's role in medical imaging infrastructure (Rescana). Red Hat also acknowledged the CVE in their security tracking (Red Hat).