CVE-2026-5440
Memory Exhaustion via Unbounded Content-Length
A memory exhaustion vulnerability exists in the HTTP server due to unbounded use of the Content-Length header. The server allocates memory directly based on the attacker supplied header value without enforcing an upper limit. A crafted HTTP request containing an extremely large Content-Length value can trigger excessive memory allocation and server termination, even without sending a request body.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Memory Exhaustion via Unbounded Content-Length
A memory exhaustion vulnerability exists in the HTTP server due to unbounded use of the Content-Length header. The server allocates memory directly based on the attacker supplied header value without enforcing an upper limit. A crafted HTTP request containing an extremely large Content-Length value can trigger excessive memory allocation and server termination, even without sending a request body.
- Record
CVE-2026-5440- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
EUVDEUVD-2026-20917
A memory exhaustion vulnerability exists in the HTTP server due to unbounded use of the Content-Length header. The server allocates memory directly based on the attacker supplied header value without enforcing an upper limit. A crafted HTTP request containing an extremely large Content-Length value can trigger excessive memory allocation and server termination, even without sending a request body.
- Record
EUVD-2026-20917- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-826q-ppf7-8g9v
A memory exhaustion vulnerability exists in the HTTP server due to unbounded use of the `Content...
A memory exhaustion vulnerability exists in the HTTP server due to unbounded use of the Content-Length header. The server allocates memory directly based on the attacker supplied header value without enforcing an upper limit. A crafted HTTP request containing an extremely large Content-Length value can trigger excessive memory allocation and server termination, even without sending a request body.
- Record
GHSA-826q-ppf7-8g9v- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
NVD
A memory exhaustion vulnerability exists in the HTTP server due to unbounded use of the Content-Length header. The server allocates memory directly based on the attacker supplied header value without enforcing an upper limit. A crafted HTTP request containing an extremely large Content-Length value can trigger excessive memory allocation and server termination, even without sending a request body.
- Record
CVE-2026-5440- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-5440
A memory exhaustion vulnerability exists in the HTTP server due to unbounded use of the Content-Length header. The server allocates memory directly based on the attacker supplied header value without enforcing an upper limit. A crafted HTTP request containing an extremely large Content-Length value can trigger excessive memory allocation and server termination, even without sending a request body.
- Record
DEBIAN-CVE-2026-5440- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-5440
A memory exhaustion vulnerability exists in the HTTP server due to unbounded use of the Content-Length header. The server allocates memory directly based on the attacker supplied header value without enforcing an upper limit. A crafted HTTP request containing an extremely large Content-Length value can trigger excessive memory allocation and server termination, even without sending a request body.
- Record
UBUNTU-CVE-2026-5440- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
orthancDebian:12 |
All versions, plus listed versions 1.10.1+dfsg-21.10.1+dfsg-2+deb12u11.12.1+dfsg-11.12.1+dfsg-21.12.1+dfsg-3 Show 31 moreShow less1.12.1+dfsg-41.12.10+dfsg-11.12.10+dfsg-21.12.10+dfsg-31.12.10+dfsg-41.12.10+dfsg-51.12.11+dfsg-11.12.11+dfsg-21.12.11+dfsg-31.12.11+dfsg-41.12.11+dfsg-51.12.11+dfsg-61.12.11+dfsg-71.12.11+dfsg-81.12.2+dfsg-11.12.3+dfsg-11.12.3+dfsg-21.12.4+dfsg-11.12.4+dfsg-21.12.4+dfsg-31.12.4+dfsg-41.12.5+dfsg-11.12.5+dfsg-21.12.6+dfsg-11.12.7+dfsg-11.12.7+dfsg-21.12.7+dfsg-31.12.7+dfsg-41.12.9+dfsg-11.12.9+dfsg-21.13.0+dfsg-1 |
None known |
orthancDebian:13 |
All versions, plus listed versions 1.12.10+dfsg-11.12.10+dfsg-21.12.10+dfsg-31.12.10+dfsg-41.12.10+dfsg-5 Show 12 moreShow less1.12.11+dfsg-11.12.11+dfsg-21.12.11+dfsg-31.12.11+dfsg-41.12.11+dfsg-51.12.11+dfsg-61.12.11+dfsg-71.12.11+dfsg-81.12.7+dfsg-41.12.9+dfsg-11.12.9+dfsg-21.13.0+dfsg-1 |
None known |
orthancDebian:14 |
before 1.12.10+dfsg-4, plus listed versions 1.12.10+dfsg-11.12.10+dfsg-21.12.10+dfsg-31.12.7+dfsg-41.12.9+dfsg-11.12.9+dfsg-2 |
1.12.10+dfsg-4 |
orthancUbuntu:16.04:LTS |
All versions, plus listed versions 0.9.4+dfsg-10.9.4+dfsg-20.9.5+dfsg-11.0.0+dfsg-11.0.0+dfsg-1build1 |
None known |
orthancUbuntu:18.04:LTS |
All versions, plus listed versions 1.3.0+dfsg-1build11.3.0+dfsg-1build21.3.1+dfsg-11.3.1+dfsg-1build11.3.1+dfsg-1build2 |
None known |
orthancUbuntu:20.04:LTS |
All versions, plus listed versions 1.5.7+dfsg-21.5.8+dfsg-21.5.8+dfsg-2ubuntu21.5.8+dfsg-2ubuntu31.5.8+dfsg-2ubuntu41.5.8+dfsg-2ubuntu51.5.8+dfsg-2ubuntu6 |
None known |
orthancUbuntu:22.04:LTS |
All versions, plus listed versions 1.9.2+really1.9.1+dfsg-11.9.7+dfsg-3ubuntu11.9.7+dfsg-3ubuntu21.9.7+dfsg-41.9.7+dfsg-51.9.7+dfsg-61.10.0+dfsg-1 |
None known |
orthancUbuntu:24.04:LTS |
All versions, plus listed versions 1.12.1+dfsg-31.12.1+dfsg-41.12.1+dfsg-4build11.12.2+dfsg-11.12.2+dfsg-1build31.12.2+dfsg-1build4 |
None known |
orthancUbuntu:25.10 |
All versions, plus listed versions 1.12.6+dfsg-11.12.7+dfsg-41.12.7+dfsg-4build2 |
None known |
orthancUbuntu:26.10 |
All versions, plus listed versions 1.12.10+dfsg-21.12.11+dfsg-81.12.11+dfsg-8build1 |
None known |
orthancUbuntu:26.04:LTS |
All versions, plus listed versions 1.12.7+dfsg-4build21.12.9+dfsg-21.12.10+dfsg-11.12.10+dfsg-1build11.12.10+dfsg-2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-5440 is a high vulnerability (CVSS 7.5) in Orthanc Dicom Server, published April 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.59%, the 48th percentile. Fixed in orthanc 1.12.10+dfsg-4.