PT-2026-31628 · Orthanc · Orthanc

Published 2026-04-09 · Updated 2026-04-09 · CVE-2026-5439

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Orthanc (affected versions not specified)

Description A memory exhaustion issue exists in ZIP archive processing. Orthanc automatically extracts ZIP archives uploaded to certain endpoints and relies on metadata fields indicating the uncompressed size of archived files. An attacker can create a small ZIP archive with a manipulated size value, leading the server to allocate substantial buffers during extraction.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-5439

Affected Products

Orthanc

References · 11

• https://cve.org/CVERecord?id=CVE-2026-5439 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-5439 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-5439 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-5439 · Security Note
• https://ubuntu.com/security/CVE-2026-5439 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-5439 · Vendor Advisory
• https://machinespirits.de · Note
• https://kb.cert.org/vuls/id/536588 · Note
• https://orthanc-server.com · Note
• https://twitter.com/CVEnew/status/2042302818577760366 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2042344174783991823 · Twitter Post