A vulnerability exists in OFFIS DCMTK 3.7.0 where the JSON parser performs uncontrolled mutual recursion among the functions parseDataSet, parseElement, and parseSequence. A well‑crafted DICOM JSON document that contains deeply nested sequence values triggers this recursion, exhausting the call stack and causing the process to crash. The flaw is an example of CWE‑674 and CWE‑770 weaknesses, leading to a denial of service for any application that reads untrusted DICOM JSON.

The affected systems are OFFIS DCMTK version 3.7.0 and any earlier releases that use the same JSON parsing code. Services that convert untrusted DICOM JSON, such as the json2dcm utility or DICOMweb payload converters that rely on this parser, are impacted because they invoke the vulnerable routines.

The CVSS score of 6.8 indicates a moderate risk. No EPSS score is provided and the vulnerability is not listed in CISA KEV, yet an attacker can exploit it by delivering a deeply nested JSON document over any interface that processes DICOM JSON, such as DICOMweb services or batch import tools. The attack requires only crafted input; it can be performed remotely if the target accepts user supplied JSON.