Orthanc-server vulnerabilities

Products

• Orthanc 13

Newest

• orthanc-server orthanc, orthanc dicom server +1 more Memory Exhaustion via Forged ZIP Metadata CVE-2026-5439 Fix available 7.5 HighApril 9, 2026
• orthanc dicom server, orthanc-server orthanc +1 more Out-of-Bounds Read in DicomStreamReader CVE-2026-5437 Fix available 7.5 HighApril 9, 2026
• orthanc-server orthanc, orthanc dicom server +1 more Gzip Decompression Bomb via Content-Encoding Header CVE-2026-5438 Fix available 7.5 HighApril 9, 2026
• orthanc dicom server, orthanc-server orthanc +1 more Memory Exhaustion via Unbounded Content-Length CVE-2026-5440 Fix available 7.5 HighApril 9, 2026
• orthanc dicom server, orthanc-server orthanc +1 more Heap Buffer Overflow in DICOM Image Decoder via VR UL Dimensions CVE-2026-5442 Fix available 9.8 CriticalApril 9, 2026
• orthanc dicom server, orthanc-server orthanc +1 more Heap Buffer Overflow in DICOM Image Decoder (Palette Color Decode) CVE-2026-5443 Fix available 9.8 CriticalApril 9, 2026
• orthanc dicom server, orthanc-server orthanc +1 more Out-of-Bounds Read in DicomImageDecoder (DecodeLookupTable) CVE-2026-5445 Fix available 9.1 CriticalApril 9, 2026
• orthanc-server orthanc, orthanc dicom server +1 more Heap Buffer Overflow in PAM Image Buffer Allocation CVE-2026-5444 Fix available 7.1 HighApril 9, 2026
• orthanc dicom server, orthanc-server orthanc +1 more Out-of-Bounds Read in DicomImageDecoder (PMSCT_RLE1 Decompression) CVE-2026-5441 Fix available 7.1 HighApril 9, 2026
• orthanc-server orthanc Orthanc versions before 1.12.10 are affected by an authorisation logic flaw in the application's... CVE-2025-15581 Fix available 4.7 MediumFebruary 18, 2026
• orthanc server, orthanc-server orthanc +1 more Orthanc Server Missing Authentication for Critical Function CVE-2025-0896 Fix available 9.2 CriticalFebruary 13, 2025
• orthanc-server orthanc Orthanc versions before 1.12.2 are affected by a reflected cross-site scripting (XSS)... CVE-2024-22725 Fix available 6.1 MediumJanuary 24, 2024
• orthanc osimis dicom web viewer, orthanc-server osimis web viewer +1 more Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Orthanc Osimis DICOM Web Viewer CVE-2023-7238 7.1 HighJanuary 23, 2024
• orthanc-server orthanc Orthanc before 1.12.0 allows authenticated users with access to the Orthanc API to overwrite... CVE-2023-33466 Fix available 8.8 HighJune 29, 2023