High severity7.5NVD Advisory· Published Apr 9, 2026· Updated Apr 14, 2026
CVE-2026-5440
CVE-2026-5440
Description
A memory exhaustion vulnerability exists in the HTTP server due to unbounded use of the Content-Length header. The server allocates memory directly based on the attacker supplied header value without enforcing an upper limit. A crafted HTTP request containing an extremely large Content-Length value can trigger excessive memory allocation and server termination, even without sending a request body.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
3- kb.cert.org/vuls/id/536588nvdThird Party AdvisoryVDB Entry
- www.machinespirits.denvdNot Applicable
- www.orthanc-server.comnvdProduct
News mentions
0No linked articles in our index yet.