A gzip decompression bomb vulnerability exists when Orthanc processes HTTP request with `Content-Encoding: gzip`. The server does not enforce limits on decompressed size and allocates memory based on attacker-controlled compression metadata. A specially crafted gzip payload can trigger excessive memory allocation and exhaust system memory.
References
| Link | Resource |
|---|---|
| https://kb.cert.org/vuls/id/536588 | Third Party Advisory VDB Entry |
| https://www.machinespirits.de/ | Not Applicable |
| https://www.orthanc-server.com/ | Product |
Configurations
History
15 Apr 2026, 19:31
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:orthanc-server:orthanc:*:*:*:*:*:*:*:* | |
| CWE | CWE-770 | |
| First Time |
Orthanc-server
Orthanc-server orthanc |
|
| References | () https://kb.cert.org/vuls/id/536588 - Third Party Advisory, VDB Entry | |
| References | () https://www.machinespirits.de/ - Not Applicable | |
| References | () https://www.orthanc-server.com/ - Product |
14 Apr 2026, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
09 Apr 2026, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-09 15:16
Updated : 2026-04-15 19:31
NVD link : CVE-2026-5438
Mitre link : CVE-2026-5438
CVE.ORG link : CVE-2026-5438
JSON object : View
Products Affected
orthanc-server
- orthanc
CWE
CWE-770
Allocation of Resources Without Limits or Throttling