What’s Vulnerable › Vulnerabilities

CVE-2021-41690

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-06-28 · updated 2026-06-17
• Weakness: CWE-401

Description

DCMTK through 3.6.6 does not handle memory free properly. The malloced memory for storing all file information are recorded in a global variable LST and are not freed properly. Sending specific requests to the dcmqrdb program can incur a memory leak. An attacker can use it to launch a DoS attack.

Affected products

• OFFIS DCMTK: through 3.6.6

References

• https://github.com/DCMTK/dcmtk
• https://github.com/DCMTK/dcmtk/commit/a9697dfeb672b0b9412c00c7d36d801e27ec85cb
• https://lists.debian.org/debian-lts-announce/2024/06/msg00022.html
• https://github.com/DCMTK/dcmtk
• https://github.com/DCMTK/dcmtk/commit/a9697dfeb672b0b9412c00c7d36d801e27ec85cb
• https://lists.debian.org/debian-lts-announce/2024/06/msg00022.html
• https://lists.debian.org/debian-lts-announce/2025/01/msg00032.html

Get alerted when CVE-2021-41690 or the next vulnerability affects your stack