Hi,

The following vulnerability was published for dcmtk.

CVE-2026-44031[0]:
| Uncontrolled recursion in DcmSequenceOfItems::read() and
| DcmItem::read() in the dcmdata library of OFFIS DCMTK 3.7.0 allows a
| remote, unauthenticated attacker to cause a denial of service (stack
| exhaustion and process crash) via a DICOM dataset containing deeply
| nested sequences (SQ elements). The dataset can be sent in a C-STORE
| request to storescp, dcmrecv, dcmqrscp, or any other DICOM service
| built on DCMTK, because the received dataset is parsed before any
| authentication takes place. Local tools such as dcmdump also crash
| when opening such a file. The issue is fixed in commit
| 885ff0f10372bd589b5f44cea974f28a3964cb0f, which adds a configurable
| sequence nesting depth limit (default 64).


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-44031
https://www.cve.org/CVERecord?id=CVE-2026-44031
[1] https://support.dcmtk.org/redmine/issues/1191
[2] https://github.com/DCMTK/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore