A memory exhaustion vulnerability exists in the HTTP server due to unbounded use of the `Content-Length` header. The server allocates memory directly based on the attacker supplied header value without enforcing an upper limit. A crafted HTTP request containing an extremely large `Content-Length` value can trigger excessive memory allocation and server termination, even without sending a request body.
References
| Link | Resource |
|---|---|
| https://kb.cert.org/vuls/id/536588 | Third Party Advisory VDB Entry |
| https://www.machinespirits.de/ | Not Applicable |
| https://www.orthanc-server.com/ | Product |
Configurations
History
14 Apr 2026, 20:26
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-770 | |
| First Time |
Orthanc-server
Orthanc-server orthanc |
|
| CPE | cpe:2.3:a:orthanc-server:orthanc:*:*:*:*:*:*:*:* | |
| References | () https://kb.cert.org/vuls/id/536588 - Third Party Advisory, VDB Entry | |
| References | () https://www.machinespirits.de/ - Not Applicable | |
| References | () https://www.orthanc-server.com/ - Product |
14 Apr 2026, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
09 Apr 2026, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-09 15:16
Updated : 2026-04-14 20:26
NVD link : CVE-2026-5440
Mitre link : CVE-2026-5440
CVE.ORG link : CVE-2026-5440
JSON object : View
Products Affected
orthanc-server
- orthanc
CWE
CWE-770
Allocation of Resources Without Limits or Throttling