CVE-2026-5440: 
NixOS vulnerability analysis and mitigation

CVE-2026-5440 is a memory exhaustion (Denial of Service) vulnerability in the Orthanc DICOM Server's HTTP server component, caused by unbounded allocation based on the attacker-supplied Content-Length header. It affects Orthanc versions up to and including 1.12.10; version 1.12.11 addresses the flaw. The vulnerability was disclosed on April 9, 2026, by Dr. Simon Weber and Volker Schönefeld of Machine Spirits UG, coordinated through CERT/CC (VU#536588). It carries a CVSS v3.1 base score of 7.5 (High) (CERT/CC Advisory, GitHub Advisory).

The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling): Orthanc's HTTP server reads the Content-Length header value supplied by the client and allocates a memory buffer of that size without enforcing any upper bound. An attacker can send a crafted HTTP request specifying an extremely large Content-Length value (e.g., approximately 4 GB) without transmitting an actual request body, causing the server to attempt the allocation and exhaust available system memory, ultimately terminating the process. No authentication or special privileges are required to trigger this condition. The specific advisory from the researchers is available at https://www.machinespirits.de/advisory/1f0f72/ (CERT/CC Advisory).

Successful exploitation results in a complete denial of service — the Orthanc server process terminates due to memory exhaustion, disrupting availability of the DICOM medical imaging service. There is no confidentiality or integrity impact from this specific vulnerability. In healthcare environments where Orthanc is used to store and retrieve medical imaging data, server termination can interrupt clinical workflows and access to patient imaging records (CERT/CC Advisory, GitHub Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability is trivially exploitable by any unauthenticated network attacker with access to the Orthanc HTTP port, requiring only a single crafted HTTP request. The EPSS score is approximately 1.89% (84th percentile), indicating a moderate near-term exploitation probability. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Nessus plugin 305819 is available for detection (Feedly).

1. Reconnaissance: Identify internet-facing or network-accessible Orthanc DICOM Server instances (default HTTP port 8042) using tools like Shodan, Censys, or network scanning tools such as nmap, targeting versions prior to 1.12.11.
2. Craft malicious HTTP request: Construct an HTTP POST (or PUT) request to any valid Orthanc REST API endpoint (e.g., /instances) with an extremely large Content-Length header value (e.g., Content-Length: 4294967295 for ~4 GB) but with no actual request body.
3. Send the request: Transmit the crafted request to the target server. No authentication credentials are required.
4. Trigger memory exhaustion: The Orthanc HTTP server allocates a buffer matching the declared Content-Length value without validation, exhausting available system memory and causing the server process to terminate, resulting in denial of service (CERT/CC Advisory, GitHub Advisory).

• Network: Inbound HTTP requests to the Orthanc server (default port 8042) with abnormally large Content-Length header values (e.g., values in the gigabyte range) and minimal or no request body transmitted; single-packet or short-lived TCP connections with oversized headers.
• Logs: Orthanc server logs showing abrupt process termination or out-of-memory errors; HTTP access logs recording requests with extremely large Content-Length values from unexpected source IPs.
• Process/System: Sudden spike in memory consumption by the Orthanc process followed by process crash; OS-level out-of-memory (OOM) killer events logged in system logs (e.g., /var/log/syslog or dmesg) attributing termination to the Orthanc process.

Orthanc has released version 1.12.11 to address CVE-2026-5440, and all users are strongly encouraged to upgrade immediately (CERT/CC Advisory). As interim mitigations prior to patching, administrators should deploy a reverse proxy or WAF in front of Orthanc configured to reject HTTP requests with Content-Length values exceeding a reasonable threshold (e.g., the maximum expected upload size). Additionally, restricting network access to the Orthanc HTTP port (default 8042) to trusted hosts and networks reduces exposure. Monitoring server memory usage for anomalous spikes can provide early warning of exploitation attempts.

The vulnerability was part of a coordinated disclosure of nine vulnerabilities in Orthanc by researchers Dr. Simon Weber and Volker Schönefeld of Machine Spirits UG, reported through CERT/CC (CERT/CC Advisory). Security news outlets including Security Online and News4Hackers covered the broader set of Orthanc vulnerabilities, highlighting the healthcare sector risk given Orthanc's role in medical imaging infrastructure. Rescana and BeyondMachines published analyses noting the potential for crashes and remote code execution across the vulnerability set. Red Hat also tracked the CVE, indicating relevance to Linux distribution ecosystems (Feedly).