A request handling flaw in the Orthanc DICOM Server’s HTTP component allows an adversary to set an arbitrarily large Content-Length header. The server allocates memory proportional to the header value without any cap, meaning that a crafted request can cause excessive memory consumption and terminate the server even if the request body is omitted. The consequence is a loss of availability; the server becomes unresponsive and must be restarted, but no data is directly disclosed or corrupted.

The Orthanc DICOM Server is the affected product. No specific version range is listed in the CNA data, so the vulnerability may apply to any unsupported or older releases of Orthanc that still use the default HTTP server handling. Users should verify their installed version against Orthanc release notes for any mention of this issue.

The Common Vulnerability Scoring System score is not provided, and EPSS data is unavailable, so exact numerical risk cannot be calculated from the source. The issue is not listed in the CISA KEV catalog, indicating no known widespread exploitation. Nevertheless, the lack of bounds on memory allocation makes the vulnerability highly exploitable; an attacker merely needs to send a single HTTP request with a large Content-Length, a technique that can be automated or performed manually. Because the flaw leads to denial of service, it poses a significant operational threat to any system hosting Orthanc and exposing the HTTP interface.