A gzip decompression bomb vulnerability exists when Orthanc processes HTTP requests with a Content-Encoding header set to gzip. The server does not enforce limits on the decompressed size and allocates memory based on attacker‑controlled compression metadata. An attacker can craft a gzip payload that causes the server to allocate excessive memory, eventually exhausting system memory or crashing the service. This results in a denial of service to all users of the DICOM server. The weakness corresponds to uncontrolled resource consumption (CWE‑770).

Orthanc DICOM Server is the affected product. No specific affected versions are listed in the CVE, so all installations that accept gzip‑encoded requests may be vulnerable until patched or disabled.

The vulnerability is remotely exploitable via HTTP traffic by sending a malicious gzip payload. While CVSS and EPSS scores are not available, a memory exhaustion attack can have a high operational impact if the server is reachable from an attacker, potentially causing prolonged downtime. The absence from the CISA KEV list suggests no known active exploitation yet, but the exploitability remains significant due to the simplicity of the attack vector.