Actions
Bug #1226
closed
Unbound recursion in DSRDocumentTreeNode::readXML()
Start date:
2026-06-17
Due date:
% Done:
100%
Estimated time:
1:00 h
Module:
dcmsr
Operating System:
Compiler:
Description
Currently, the XML to DICOM SR parser relies on a depth gate in libxml2 to prevent unbound recursion when reading a malformed XML file.
However, since the code was designed to permit easy replacement of the underlying XML parser, an explicit recursion limit should be added to DSRDocumentTreeNode::readXML().
Reported 2026-05-19 by Arjun Basnet, Senior Security Researcher, Securin.
This issue has been registered as CVE-2026-44032.
Updated by Marco Eichelberg 2 days ago
- Assignee set to Marco Eichelberg
- % Done changed from 0 to 100
- Estimated time set to 1:00 h
- Private changed from No to Yes
Closed by commit #9057782f9.
Actions