J4care Dcm4chee-Arc-Light
4 CVEs affecting J4care Dcm4chee-Arc-Light. Latest disclosed: 2026-10-16. Critical: 2, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-97851 | Critical | 9.1 | 2026-10-16 | The storage status-change REST service allows location records still associated with DICOM instances to be changed to deletion-related states. Changing a locat… |
CVE-2026-105279 | Critical | 9.1 | 2026-10-16 | In the default configuration, the archive accepts DICOM associations from an unregistered calling AE. A remote peer can use C-FIND and C-GET to enumerate and r… |
CVE-2026-105667 | High | 7.5 | 2026-10-16 | In the default configuration, the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending application. A remote sender can reass… |
CVE-2026-101021 | High | 7.5 | 2026-10-16 | MultipartInputStream performs inefficient boundary matching and unnecessary buffer copying. Crafted multipart input can force excessive boundary comparisons an… |