High severity7.5NVD Advisory· Published Jun 30, 2026· Updated Jul 1, 2026

CVE-2026-35505

Description

An unauthenticated remote attacker can repeatedly send crafted connection requests to leak memory. In single-process deployments the memory grows until the service is killed and the port stops responding until restart.

Affected products

Debian/dcmtkllm-create

Patches

Vulnerability mechanics

References

github.com/DCMTK/dcmtk/releases/tag/latestnvd
github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-181-01.jsonnvd
www.cisa.gov/news-events/ics-medical-advisories/icsma-26-181-01nvd

News mentions

DICOM Toolkit Bugs Raise Medical Imaging Security Risks
GovInfoSecurity · Jun 30, 2026
OFFIS DCMTK Toolkit
CISA Alerts

cvss	0.488
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000