Hi,

The following vulnerability was published for dcmtk.

CVE-2026-44037[0]:
| Uncontrolled mutual recursion between DcmJSONReader::parseDataSet(),
| DcmJSONReader::parseElement() and DcmJSONReader::parseSequence() in
| dcmdata/libsrc/dcjsonrd.cc of OFFIS DCMTK 3.7.0 allows an attacker
| to cause a denial of service (stack exhaustion and process crash)
| via a crafted DICOM JSON document with deeply nested sequence (SQ)
| values. The json2dcm tool and any service that converts untrusted
| DICOM JSON (for example, DICOMweb payloads) with this reader are
| affected. The issue is fixed in commit
| cf955e64c35a1e07ba10698f639d5dcdec53b9d7.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-44037
https://www.cve.org/CVERecord?id=CVE-2026-44037
[1] https://support.dcmtk.org/redmine/issues/1225
[2] https://github.com/DCMTK/dcmtk/commit/cf955e64c35a1e07ba10698f639d5dcdec53b9d7

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore