MultipartInputStream implements a naïve boundary matching algorithm that repeatedly scans input streams and copies buffers unnecessarily. An attacker who can supply a crafted multipart HTTP request with a boundary designed to trigger excessive comparisons and repeated copying can cause the application to perform a worst‑case O(n²) operation, consuming large amounts of CPU and allocating oversized temporary buffers. This gives the attacker a means to deny service to legitimate users of the dcm4chee-arc-light system.

The vulnerability resides in J4Care’s dcm4chee-arc-light medical imaging server. A fix has been released in version 5.35.2 and later; any earlier release is susceptible.

The flaw carries a CVSS score of 8.7, indicating high severity. No EPSS data is available and the issue is not catalogued in CISA’s KEV, so the current exploitation probability is unknown, but the potential impact is significant. Based on the description, the likely attack vector involves sending a specially crafted multipart request to a web endpoint that accepts file uploads, meaning an attacker only needs to target the HTTP service to trigger the DoS.