Hi,

The following vulnerability was published for dcmtk.

CVE-2026-44033[0]:
| Uncontrolled recursion in XMLNode::ParseXMLElement() and
| XMLNode::emptyTheNode() in the bundled XML parser
| (ofstd/libsrc/ofxml.cc) of OFFIS DCMTK 3.7.0 allows an attacker to
| cause a denial of service (stack exhaustion and process crash) via a
| crafted XML document with deeply nested elements. The parser is
| reachable through dcmencap when encapsulating a CDA document, and
| through any application that calls OFXMLParser::parseFile() or
| OFXMLParser::parseString() on untrusted input. The issue is fixed in
| commit d12e350e687530eb41e2b0c860aff4d8c04e5941.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-44033
https://www.cve.org/CVERecord?id=CVE-2026-44033
[1] https://support.dcmtk.org/redmine/issues/1214
[2] https://github.com/DCMTK/dcmtk/commit/d12e350e687530eb41e2b0c860aff4d8c04e5941

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore