DCMTK

Today

12:12 Bug #1204 (New): Added flag/option to ignore SR template constraints.

Now that the root concept name of an SR document is checked (if the document is based on an SR template and the DICOM... Jörg Riesmeier

2026-04-10

17:09 Feature #1203 (New): Remove DCMTK specific implementations of STL classes

For DCMTK 3.7.2, the DCMTK specific implementations of STL classes such as string, list, vector, stack etc. should be... Marco Eichelberg

17:07 Feature #1202 (New): Remove C++98 support and enable STL by default

In DCMTK 3.7.1, support for C++ 98, which is already deprecated, should be completely removed. A C++ language level o... Marco Eichelberg

13:48 Feature #570: Check whether the use of DcmSequenceOfItems::getItem(index) could be enhanced (or avoided?)

See commit f58412bf8: Improved performance of DcmList::seek_to(). Jörg Riesmeier

11:02 Feature #362 (Feedback): Unterstützung von "UUID as UID"

Please take a look at suggested changes in attached 'diff'. Harald Roesen

2026-04-09

18:11 Bug #1201 (Closed): Concatenation creation fails on Big Endian 16 Bit data

Fixed with commit c028eab. Michael Onken

18:09 Bug #1201 (Closed): Concatenation creation fails on Big Endian 16 Bit data

When creating Concatenations with 16 bit pixel data (VR OW) on Big Endian machines, the resulting pixel is byte-swapp... Michael Onken

2026-04-07

10:33 Bug #1194: OS command injection vulnerability in storescp --exec-on-reception

This issue has been assigned CVE number CVE-2026-5663 (https://vuldb.com/vuln/355486).
Marco Eichelberg

2026-04-04

09:06 Bug #1188 (Closed): Assertion failure in JPEG-LS encoder

Closed by commit #08c4c8734.
Marco Eichelberg

2026-04-02

18:26 Feature #1200 (New): Functionality to get tag path for a given element

A "user on StackOverflow":https://stackoverflow.com/questions/79652444/getting-the-tag-path-of-a-particular-dcmelemen... Michael Onken

2026-03-29

14:51 Bug #1198 (Closed): Path Traversal in JSON Bulkdata Loading

Closed by commit #969c4b6f2.
Marco Eichelberg

10:05 Bug #1197 (Closed): Uninitialized Memory Read in JSMN Token Array

Closed by commit #ae94a3d75.
Marco Eichelberg

09:03 Bug #1196 (Closed): SEGV via OOB Read in DcmJSONReader getTokenContent

Closed by commit #4add0621b (i.e. the same commit that also closed DCMTK issue #1193.) Marco Eichelberg

2026-03-28

20:08 Bug #1195 (Closed): Heap OOB Read via PersonName Path in DcmJSONReader

Closed by commit #4add0621b (i.e. the same commit that also closed DCMTK issue #1193.) Marco Eichelberg

18:22 Bug #1193 (Closed): Heap OOB Read in DcmJSONReader getTokenContent

Closed by commit #4add0621b.
Marco Eichelberg

2026-03-25

10:14 Bug #1198 (Closed): Path Traversal in JSON Bulkdata Loading

Received by email from the IN-CYPHER OSS Security Team (2026-03-24):
> *Subject:* IC-DCMTK-0024: Path Traversal in... Jörg Riesmeier

10:11 Bug #1197 (Closed): Uninitialized Memory Read in JSMN Token Array

Received by email from the IN-CYPHER OSS Security Team (2026-03-24):
> *Subject:* IC-DCMTK-0009 Uninitialized Memo... Jörg Riesmeier

10:09 Bug #1196 (Closed): SEGV via OOB Read in DcmJSONReader getTokenContent

Received by email from the IN-CYPHER OSS Security Team (2026-03-24):
> *Subject:* IC-DCMTK-0008 SEGV via OOB Read ... Jörg Riesmeier

10:06 Bug #1195 (Closed): Heap OOB Read via PersonName Path in DcmJSONReader

Received by email from the IN-CYPHER OSS Security Team (2026-03-24):
> *Subject:* IC-DCMTK-0007 Heap OOB Read via ... Jörg Riesmeier

2026-03-24

09:21 Bug #1194: OS command injection vulnerability in storescp --exec-on-reception

Also see: https://machinespirits.com/advisory/2e1627/
Marco Eichelberg

2026-03-21

18:35 Bug #1194 (Closed): OS command injection vulnerability in storescp --exec-on-reception

Closed by DCMTK commit #edbb085e4.
Marco Eichelberg

18:23 Bug #1194: OS command injection vulnerability in storescp --exec-on-reception

This vulnerability only affects the @storescp@ command line tool, not the underlying libraries. The vulnerability is ... Marco Eichelberg