A gzip decompression bomb vulnerability exists when Orthanc processes HTTP request with `Content-Encoding: gzip`. The server does not enforce limits on decompressed size and allocates memory based on attacker-controlled compression metadata. A specially crafted gzip payload can trigger excessive memory allocation and exhaust system memory.
CVE-2026-5438
NONE
EPSS 0.06%
Updated Apr 09, 2026
Payload
CVE Details
CVE ID
CVE-2026-5438
Published Date
Apr 09, 2026
Vendor
Payload
Severity
NONE
Exploit Prediction (EPSS)
Probability of Exploit
0.06%
Likelihood of exploitation in next 30 days
Percentile:
17.1th percentile (higher than 17.1% of all CVEs)
Standard patching cycle
Impact
Minimal impact
Source
View Advisory