# CVE-2026-101021: J4Care dcm4chee-arc-light inefficient algorithmic complexity in multipart parsing

Source: https://junglewise.ai/threats/cve-2026-101021-multipartinputstream-performs-inefficient-boundary-matching-and  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-16. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-101021 · Severity: high · CVSS 7.5 · Published 2026-10-16

J4Care dcm4chee-arc-light is a medical imaging system that processes and stores DICOM images in healthcare environments. An attacker can craft malicious multipart input that forces excessive boundary comparisons and buffer copying, triggering a denial-of-service condition that disrupts patient care and system availability.

Technologies: [J4Care Dcm4chee-Arc-Light](https://junglewise.ai/threats/technologies/dcm4chee-arc-light). Vendors: [J4Care](https://junglewise.ai/threats/vendors/j4care).

## Quick answers

**Is CVE-2026-101021 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-101021 being exploited in the wild.

**How severe is CVE-2026-101021?** High severity, with a CVSS score of 7.5, published 16 October 2026.

**Which products and versions are affected?** J4Care Dcm4chee-Arc-Light 5.35.1.

**Is there a fix for CVE-2026-101021?** Yes: fixed in dcm4chee-arc-light 5.35.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-101021 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-101021?** Check whether you run J4Care Dcm4chee-Arc-Light at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in dcm4chee-arc-light 5.35.2

## Technical details

CVE-2026-101021 is an inefficient algorithmic complexity vulnerability (CWE-407) in MultipartInputStream where crafted multipart input causes excessive boundary matching operations and repeated buffer copying, leading to CPU exhaustion. The vulnerability requires only network access with no authentication or user interaction. Exploitation results in denial of service; a fix is available in version 5.35.2 and later.

## Affected products

- J4Care dcm4chee-arc-light 5.35.1

## Timeline

- 2026-10-15: disclosed
- 2026-10-16: advisory

## References

- [https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-288-02.json](https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-288-02.json)
- [https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-02](https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-02)

## Related threats

- [J4Care dcm4chee-arc-light multiple vulnerabilities](https://junglewise.ai/threats/cve-2026-97851-j4care-dcm4che)
- [J4Care dcm4che JPEGParser infinite loop in JPEG parsing](https://junglewise.ai/threats/cve-2026-107621-jpegparser-can-enter-an-infinite-loop-while-parsing-a-specially)
- [J4Care dcm4che HL7 listener missing authentication for patient merge](https://junglewise.ai/threats/cve-2026-105667-in-the-default-configuration-the-hl7-listener-accepts-adt-a40)
- [J4Care dcm4chee-arc-light DICOM authentication bypass](https://junglewise.ai/threats/cve-2026-105279-in-the-default-configuration-the-archive-accepts-dicom)
- [J4Care dcm4chee-arc-light MP4Parser infinite loop in MP4 box parsing](https://junglewise.ai/threats/cve-2026-105273-mp4parser-does-not-adequately-validate-mp4-box-sizes-a-malformed)