Quick answers
- Is CVE-2026-35505 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-35505 being exploited in the wild.
- How severe is CVE-2026-35505?
- High severity, with a CVSS score of 7.5, published 30 June 2026.
- Which products and versions are affected?
- OFFIS DCMTK Toolkit <=3.7.0.
- Is there a fix for CVE-2026-35505?
- A patch was published on 2026-06-25: Fix included in latest commits on GitHub Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-35505 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-35505?
- Check whether you run OFFIS DCMTK Toolkit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A memory leak vulnerability (CWE-401) exists in the OFFIS DCMTK Toolkit versions 3.7.0 and prior. The flaw is triggered when the software fails to properly release memory after processing specifically crafted connection requests. In single-process deployments, an unauthenticated remote attacker can exploit this by repeatedly sending these requests, causing memory consumption to grow until the process is terminated by the operating system. This results in a denial-of-service (DoS) where the service port stops responding until a manual restart is performed. A fix has been provided in the latest GitHub commits for the toolkit.
Affected products
- OFFIS DCMTK Toolkit <=3.7.0
Timeline
- 2026-06-25: patched: Fix included in latest commits on GitHub
- 2026-06-30: disclosed: CISA Advisory ICSMA-26-181-01 published