Actions
Bug #1226
closed
Unbound recursion in DSRDocumentTreeNode::readXML()
Start date:
2026-06-17
Due date:
% Done:
100%
Estimated time:
1:00 h
Module:
dcmsr
Operating System:
Compiler:
Description
Currently, the XML to DICOM SR parser relies on a depth gate in libxml2 to prevent unbound recursion when reading a malformed XML file.
However, since the code was designed to permit easy replacement of the underlying XML parser, an explicit recursion limit should be added to DSRDocumentTreeNode::readXML().
Reported 2026-05-19 by Arjun Basnet, Senior Security Researcher, Securin.
This issue has been registered as CVE-2026-44032.
Updated by
Actions