CVE-2026-48705

MONAI (Medical Open Network for AI) is an AI toolkit for health care imaging. Prior to 1.6.1, PydicomReader._get_affine() trusts non-finite values in the DICOM PixelSpacing, ImagePositionPatient, and ImageOrientationPatient fields and composes them into an affine matrix without validation. An unauthenticated attacker who can upload a crafted DICOM to a default MONAILabel deployment can propagate NaN or infinity values through LoadImaged, Spacingd, model inference, and output writing, causing inference failures, persistent datastore poisoning, or geometrically corrupted results. This issue is fixed in version 1.6.1.

MONAI (Medical Open Network for AI) is an AI toolkit for health care imaging. Prior to 1.6.1, PydicomReader._get_affine() trusts non-finite values in the DICOM PixelSpacing, ImagePositionPatient, and ImageOrientationPatient fields and composes them into an affine matrix without validation. An unauthenticated attacker who can upload a crafted DICOM to a default MONAILabel deployment can propagate NaN or infinity values through LoadImaged, Spacingd, model inference, and output writing, causing inference failures, persistent datastore poisoning, or geometrically corrupted results. This issue is fixed in version 1.6.1.

Summary

An unauthenticated remote attacker can crash a running MONAILabel server or silently corrupt its medical AI inference results by uploading a single crafted DICOM file (~132 KB) via the REST API. The vulnerability stems from pydicom's lack of validation for Decimal String (DS) and Integer String (IS) DICOM Value Representations, which allows NaN and infinity values to pass through MONAI's PydicomReader and propagate through the entire spatial transform and ML inference pipeline.

No authentication is required for the default MONAILabel REST API. The attacker needs only network access to the server (default port 8000).

Severity: CVSS 3.1: 8.7 HIGH
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:L
CWE: CWE-20 (Improper Input Validation) → CWE-682 (Incorrect Calculation)

Details

Root Cause — Layer 1: pydicom accepts invalid VR values

pydicom's DSfloat.__new__() calls Python's float(val), which silently accepts "NaN", "inf", and "-inf". The DICOM standard (PS3.5 Table 6.2-1) defines DS as digits 0-9, +, -, ., e only. NaN and inf are not valid DS values. The is_valid_ds() check only runs in RAISE validation mode, which is NOT the default. The default mode is WARN, which still returns the invalid value.

>>> from pydicom.valuerep import DSfloat
>>> DSfloat("NaN")
nan    # Accepted silently — should be rejected
>>> DSfloat("inf")
inf    # Accepted silently — should be rejected

This affects ALL pydicom versions from 0.9.7 through 3.0.2 (current).

A related bypass exists in pydicom's IS type: IS("1e4") returns 10000 via an int(float(val)) fallback, accepting scientific notation that is not valid per the DICOM standard.

Root Cause — Layer 2: MONAI Core trusts pydicom output without validation

MONAI's PydicomReader._get_affine() builds a 4x4 affine transformation matrix from PixelSpacing, ImagePositionPatient, and ImageOrientationPatient with ZERO isfinite() or isnan() checks. NaN in PixelSpacing produces NaN in the affine diagonal, propagating through every spatial transform: PydicomReader._get_affine() → LoadImaged → Spacingd → Model → Writer

Root Cause — Layer 3: MONAILabel REST API accepts anything

MONAILabel's PUT /datastore/ endpoint accepts DICOM uploads with no authentication (default deployment), no validation of spatial metadata, and no bounds checking on any DICOM tag values. The malicious DICOM is stored permanently and made available for inference.

PoC

Environment Setup:

# Start MONAILabel (Docker)
docker pull projectmonai/monailabel:latest
docker run -d --name monailabel-poc -p 8000:8000 --memory=8g \
    projectmonai/monailabel:latest monailabel start_server \
    --app /opt/monai/sample-apps/radiology \
    --studies /opt/monai/datasets/Task09_Spleen/imagesTr \
    --conf models segmentation

# Verify server is running
curl http://localhost:8000/info/

Step 1 — Establish baseline (legitimate data works):

curl -X POST "http://localhost:8000/infer/segmentation?image=spleen_40" \
     -o baseline.nii.gz -w "HTTP %{http_code} - %{size_download} bytes"
# Result: HTTP 200, ~223,628 bytes valid segmentation mask

Step 2 — Run the attack (NaN DICOM upload + inference):

pip install pydicom numpy requests
python poc_monailabel_ds_bypass.py --server http://localhost:8000

The PoC script:

1. Confirms pydicom accepts NaN/inf in DS fields
2. 2. Creates three malicious DICOM files (~132 KB each) with NaN/inf in PixelSpacing and ImagePositionPatient
3. 3. Uploads each via PUT /datastore/ (no auth required) — HTTP 200 accepted
4. 4. Triggers inference via POST /infer/segmentation — HTTP 500, server crash Demonstrated Results:

| Payload | Upload | Inference | Result | |---|---|---|---| | Baseline (spleen_40) | N/A | HTTP 200 | Valid 223 KB segmentation | | NaN PixelSpacing | HTTP 200 | HTTP 500 | RuntimeError crash (18.0s wasted compute) | | NaN…

MONAI (Medical Open Network for AI) is an AI toolkit for health care imaging. Prior to 1.6.1, PydicomReader._get_affine() trusts non-finite values in the DICOM PixelSpacing, ImagePositionPatient, and ImageOrientationPatient fields and composes them into an affine matrix without validation. An unauthenticated attacker who can upload a crafted DICOM to a default MONAILabel deployment can propagate NaN or infinity values through LoadImaged, Spacingd, model inference, and output writing, causing inference failures, persistent datastore poisoning, or geometrically corrupted results. This issue is fixed in version 1.6.1.

MONAI (Medical Open Network for AI) is an AI toolkit for health care imaging. Prior to 1.6.1, PydicomReader._get_affine() trusts non-finite values in the DICOM PixelSpacing, ImagePositionPatient, and ImageOrientationPatient fields and composes them into an affine matrix without validation. An unauthenticated attacker who can upload a crafted DICOM to a default MONAILabel deployment can propagate NaN or infinity values through LoadImaged, Spacingd, model inference, and output writing, causing inference failures, persistent datastore poisoning, or geometrically corrupted results. This issue is fixed in version 1.6.1.

Summary

An unauthenticated remote attacker can crash a running MONAILabel server or silently corrupt its medical AI inference results by uploading a single crafted DICOM file (~132 KB) via the REST API. The vulnerability stems from pydicom's lack of validation for Decimal String (DS) and Integer String (IS) DICOM Value Representations, which allows NaN and infinity values to pass through MONAI's PydicomReader and propagate through the entire spatial transform and ML inference pipeline.

No authentication is required for the default MONAILabel REST API. The attacker needs only network access to the server (default port 8000).

Severity: CVSS 3.1: 8.7 HIGH
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:L
CWE: CWE-20 (Improper Input Validation) → CWE-682 (Incorrect Calculation)

Details

Root Cause — Layer 1: pydicom accepts invalid VR values

pydicom's DSfloat.__new__() calls Python's float(val), which silently accepts "NaN", "inf", and "-inf". The DICOM standard (PS3.5 Table 6.2-1) defines DS as digits 0-9, +, -, ., e only. NaN and inf are not valid DS values. The is_valid_ds() check only runs in RAISE validation mode, which is NOT the default. The default mode is WARN, which still returns the invalid value.

>>> from pydicom.valuerep import DSfloat
>>> DSfloat("NaN")
nan    # Accepted silently — should be rejected
>>> DSfloat("inf")
inf    # Accepted silently — should be rejected

This affects ALL pydicom versions from 0.9.7 through 3.0.2 (current).

A related bypass exists in pydicom's IS type: IS("1e4") returns 10000 via an int(float(val)) fallback, accepting scientific notation that is not valid per the DICOM standard.

Root Cause — Layer 2: MONAI Core trusts pydicom output without validation

MONAI's PydicomReader._get_affine() builds a 4x4 affine transformation matrix from PixelSpacing, ImagePositionPatient, and ImageOrientationPatient with ZERO isfinite() or isnan() checks. NaN in PixelSpacing produces NaN in the affine diagonal, propagating through every spatial transform: PydicomReader._get_affine() → LoadImaged → Spacingd → Model → Writer

Root Cause — Layer 3: MONAILabel REST API accepts anything

MONAILabel's PUT /datastore/ endpoint accepts DICOM uploads with no authentication (default deployment), no validation of spatial metadata, and no bounds checking on any DICOM tag values. The malicious DICOM is stored permanently and made available for inference.

PoC

Environment Setup:

# Start MONAILabel (Docker)
docker pull projectmonai/monailabel:latest
docker run -d --name monailabel-poc -p 8000:8000 --memory=8g \
    projectmonai/monailabel:latest monailabel start_server \
    --app /opt/monai/sample-apps/radiology \
    --studies /opt/monai/datasets/Task09_Spleen/imagesTr \
    --conf models segmentation

# Verify server is running
curl http://localhost:8000/info/

Step 1 — Establish baseline (legitimate data works):

curl -X POST "http://localhost:8000/infer/segmentation?image=spleen_40" \
     -o baseline.nii.gz -w "HTTP %{http_code} - %{size_download} bytes"
# Result: HTTP 200, ~223,628 bytes valid segmentation mask

Step 2 — Run the attack (NaN DICOM upload + inference):

pip install pydicom numpy requests
python poc_monailabel_ds_bypass.py --server http://localhost:8000

The PoC script:

1. Confirms pydicom accepts NaN/inf in DS fields
2. 2. Creates three malicious DICOM files (~132 KB each) with NaN/inf in PixelSpacing and ImagePositionPatient
3. 3. Uploads each via PUT /datastore/ (no auth required) — HTTP 200 accepted
4. 4. Triggers inference via POST /infer/segmentation — HTTP 500, server crash Demonstrated Results:

| Payload | Upload | Inference | Result | |---|---|---|---| | Baseline (spleen_40) | N/A | HTTP 200 | Valid 223 KB segmentation | | NaN PixelSpacing | HTTP 200 | HTTP 500 | RuntimeError crash (18.0s wasted compute) | | NaN…