Orthanc DICOM Server can be tricked into allocating excessive memory when it processes an HTTP request that includes a 'Content-Encoding: gzip' header bearing a specially crafted, over‑compressed payload. The server trusts the gzip compression metadata to size the buffer, so the attacker can trigger an allocation that far exceeds the real payload size. This unchecked allocation flaw is a manifestation of CWE‑770 and can lead to memory exhaustion, potentially causing the service to become unresponsive or crash, thereby denying legitimate users access.

Orthanc DICOM Server. No specific product versions are listed in the available data.

The configuration results in a CVSS score of 7.5, indicating a high‑severity vulnerability. The EPSS score is below 1 %, and the issue is not currently in CISA’s KEV catalog, suggesting that large‑scale or automated exploitation is unlikely at present. However, the attack path is straightforward: any external user can send an HTTP request with the Content‑Encoding header and an adversarial gzip body; no authentication or privileged context is required. Because the server does not check decompressed size, the exploit is reliable and can be launched remotely. System administrators should treat this with high urgency, following vendor guidance for a definitive fix when it becomes available.