CVE-2026-5438Disclosure(orthanc-server / orthanc)

LOWCVSS 7.5 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

A gzip decompression bomb vulnerability exists when Orthanc processes HTTP request with `Content-Encoding: gzip`. The server does not enforce limits on decompressed size and allocates memory based on attacker-controlled compression metadata. A specially crafted gzip payload can trigger excessive memory allocation and exhaust system memory.

orthanc-server CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://kb.cert.org/vuls/id/536588

Other references

Weakness type (CWE)

CWE-770

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

orthanc

Threat summary

2 mentions across 1 observed day

What's happening

Technical details provided in 1 signal
Disclosure: 1 classified signal
General: 1 classified signal
2 total mentions across 1 day

Affected systems

Vendors

orthanc-server

Products

orthanc

Deep dive

Activity timeline2 mentions / 1d

Signal classification2 categories

Disclosure

150.0%

General

150.0%

Referenced assets3 URLs

By indicator

Full discourse2 posts

Vulmon Vulnerability Feed@VulmonFeeds182d
General
CVE-2026-5438 Gzip Decompression Bomb Vulnerability in Orthanc HTTP Requ... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-5438 Don't wait vulnerability scanning results: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=2
Post summary
The tweet simply announces CVE‑2026‑5438 and links to a Vulmon page, with no details on PoC, exploit tools, active exploitation, patches, or technical specifics.
0000040
4.0K followersView on X
CVE@CVEnew182d
Disclosure
CVE-2026-5438 A gzip decompression bomb vulnerability exists when Orthanc processes HTTP request with `Content-Encoding: gzip`. The server does not enforce limits on decompressed siz… https://www.cve.org/CVERecord?id=CVE-2026-5438
Post summary
The CVE discloses a gzip decompression bomb vulnerability in Orthanc that allows potential denial‑of‑service attacks due to unbounded decompression, with no PoC, exploit code, or remediation details included.
00000109
57.0K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	orthanc-server	orthanc	-	-	-

Explore more

Back to dashboard orthanc-server CVEs orthanc vulnerabilities