Is CVE-2026-101021 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-101021 being exploited in the wild.

How severe is CVE-2026-101021?

High severity, with a CVSS score of 7.5, published 16 October 2026.

Which products and versions are affected?

J4Care Dcm4chee-Arc-Light 5.35.1.

Is there a fix for CVE-2026-101021?

Yes: fixed in dcm4chee-arc-light 5.35.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-101021 attacked?

It is attacked over the network.

Am I affected by CVE-2026-101021?

Check whether you run J4Care Dcm4chee-Arc-Light at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-101021: J4Care dcm4chee-arc-light inefficient algorithmic complexity in multipart parsing

CVE-2026-101021 · Severity: high · CVSS 7.5 · Published 2026-10-16

J4Care dcm4chee-arc-light is a medical imaging system that processes and stores DICOM images in healthcare environments. An attacker can craft malicious multipart input that forces excessive boundary comparisons and buffer copying, triggering a denial-of-service condition that disrupts patient care and system availability.

Technologies: J4Care Dcm4chee-Arc-Light. Vendors: J4Care.

Quick answers

Is CVE-2026-101021 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-101021 being exploited in the wild.
How severe is CVE-2026-101021?: High severity, with a CVSS score of 7.5, published 16 October 2026.
Which products and versions are affected?: J4Care Dcm4chee-Arc-Light 5.35.1.
Is there a fix for CVE-2026-101021?: Yes: fixed in dcm4chee-arc-light 5.35.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-101021 attacked?: It is attacked over the network.
Am I affected by CVE-2026-101021?: Check whether you run J4Care Dcm4chee-Arc-Light at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: dcm4chee-arc-light 5.35.2

Technical details

CVE-2026-101021 is an inefficient algorithmic complexity vulnerability (CWE-407) in MultipartInputStream where crafted multipart input causes excessive boundary matching operations and repeated buffer copying, leading to CPU exhaustion. The vulnerability requires only network access with no authentication or user interaction. Exploitation results in denial of service; a fix is available in version 5.35.2 and later.

Affected products

J4Care dcm4chee-arc-light 5.35.1

Timeline

2026-10-15: disclosed
2026-10-16: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.