A gzip decompression bomb vulnerability exists when Orthanc processes HTTP request with `Content-Encoding: gzip`. The server does not enforce limits on decompressed size and allocates memory based on attacker-controlled compression metadata. A specially crafted gzip payload can trigger excessive memory allocation and exhaust system memory.
CVE-2026-5438
NONE
EPSS 0.48%
Updated Apr 09, 2026
Payload
CVE Details
CVE ID
CVE-2026-5438
Published Date
Apr 09, 2026
Vendor
Payload
Severity
NONE
Exploit Prediction (EPSS)
Probability of Exploit
0.48%
Likelihood of exploitation in next 30 days
Percentile:
39.2th percentile (higher than 39.2% of all CVEs)
Standard patching cycle
Impact
Minimal impact
Source
View Advisory