Orthanc DICOM Server Gzip Decompression Bomb Vulnerability

A vulnerability allowing gzip decompression bomb attacks exists in Orthanc DICOM Server versions through 1.12.10. When the server processes HTTP requests with 'Content-Encoding: gzip', it fails to impose limits on the size of decompressed data. This oversight allows a specially crafted gzip payload to cause excessive memory allocation, leading to system memory exhaustion.

Impact

Exploitation of this vulnerability causes excessive memory allocation based on attacker-controlled compression metadata, exhausting system memory and causing denial-of-service conditions by terminating the Orthanc process.

Remediation

Users are advised to upgrade to Orthanc version 1.12.11, which addresses this vulnerability. Consult the Orthanc documentation and release notes for guidance on patching and deployment.