A supplied HTTP request with an unbounded Content-Length header causes the Orthanc server to allocate memory based on the header value without any upper bound. Because the allocation is performed directly, a crafted request can exhaust available memory, leading to a crash or refusal to process further requests. This is a classic memory exhaustion flaw (CWE‑770) that can result in denial of service for all users of the affected DICOM server.

Orthanc DICOM Server is affected. The CNA data does not specify a particular release, implying that the flaw may exist across multiple or all current releases. Administrators should verify their exact version against the official Orthanc documentation for remediation status.

The CVSS score of 7.5 indicates high severity, yet the EPSS score is 2%, suggesting a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation is possible remotely via an HTTP request that includes an extremely large Content-Length value, even without sending a body, which can trigger excessive memory allocation and terminate the server process, effectively denying service.