Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2026-35505

OFFIS DCMTK Toolkit Missing Release of Memory after Effective Lifetime

Description

An unauthenticated remote attacker can repeatedly send crafted connection requests to leak memory. In single-process deployments the memory grows until the service is killed and the port stops responding until restart.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

OFFIS DICOM DCMTK Toolkit

Default version status: unaffected

  • 0 to ≤ 3.7.0affected

References