{"id":"CVE-2026-101021","kind":"vulnerability","aliases":["CVE-2026-101021"],"related":[],"title":"MultipartInputStream: crafted upload forces slow boundary matching and copying","description":"MultipartInputStream performs inefficient boundary matching and unnecessary buffer copying. Crafted multipart input can force excessive boundary comparisons and repeated copying.","summary":"dcm4chee-arc-light (J4Care DICOM archive) 5.35.1 has a MultipartInputStream that matches boundaries inefficiently and copies buffers unnecessarily. An unauthenticated remote attacker can send crafted multipart input to burn CPU and cause denial of service. The same CISA advisory lists five other dcm4chee-arc-light CVEs, all fixed in 5.35.2.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"dcm4chee-arc-light","fixed":["5.35.2"],"affected":"5.35.1","ecosystem":"vendor"}],"ecosystems":[],"tags":["dcm4che","dcm4chee-arc-light","dos","healthcare","java","multipart-parsing","package","self-hosted"],"not_affected_if":["no-multipart-uploads","not-internet-exposed"],"how_to_check":"Check the running dcm4chee-arc-light version (archive UI or deployment image tag). 5.35.1 is confirmed affected; versions before 5.35.1 are unknown. Check whether the archive's REST/web endpoints are reachable from untrusted networks.","fix":"Upgrade dcm4chee-arc-light to 5.35.2 or later. Until then, do not expose the archive to the internet and put it behind a firewall or VPN, as CISA advises.","status":"open","published_at":"2026-10-16T15:16:58+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-23T22:39:15+00:00","updated_at":"2026-10-24T00:27:45+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T22:39:15Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"MultipartInputStream: crafted upload forces slow boundary matching and copying","impact":"medium","summary":"MultipartInputStream, a multipart form parser, does more boundary comparisons and buffer copies than needed. A crafted multipart request makes the server burn excess CPU, which an attacker can use to slow or stall the service.","category":"package","who_cares":["multipart-parsing"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Crafted requests consume excess CPU and slow or stall the service","analyst_note":"Find the affected library and fixed version in the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-101021; the sources name no product, and the 8.7 score is not explained by a description of inefficient matching.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-multipart-uploads"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.001134,"input_tokens":2861,"output_tokens":1696,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected library and fixed version in the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-101021; the sources name no product, and the 8.7 score is not explained by a description of inefficient matching.","search":"'-101021':12A,15A '-2026':11A,14A '5.35.1':42B '5.35.2':86B 'advisori':74B 'arc':18A,23B,37B,80B 'archiv':41B 'attack':57B 'boundari':6A,48B,90C,102C 'buffer':52B,94C 'burn':64B 'caus':67B 'cisa':73B 'comparison':103C 'copi':9A,51B,95C,106C 'cpu':65B 'craft':2A,60B,96C 'cve':10A,13A 'cves':82B 'dcm4che':20B 'dcm4chee':17A,22B,36B,79B 'dcm4chee-arc-light':16A,21B,35B,78B 'denial':68B 'dicom':40B 'dos':25B 'excess':101C 'five':76B 'fix':84B 'forc':4A,100C 'healthcar':26B 'host':34B 'ineffici':49B,89C 'input':62B,98C 'j4care':39B 'java':27B 'light':19A,24B,38B,81B 'list':75B 'match':7A,47B,91C 'multipart':29B,61B,97C 'multipart-pars':28B 'multipartinputstream':1A,45B,87C 'packag':31B 'pars':30B 'perform':88C 'remot':56B 'repeat':105C 'self':33B 'self-host':32B 'send':59B 'servic':70B 'slow':5A 'unauthent':55B 'unnecessari':93C 'unnecessarili':53B 'upload':3A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T15:16:58+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"ics-cert@hq.dhs.gov","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101021","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101021","severity":null,"published_at":"2026-10-16T15:16:58+00:00","modified_at":"2026-10-16T20:04:29+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-101021:666","url":null,"severity":null,"published_at":"2026-10-24T00:27:45+00:00","modified_at":"2026-10-24T00:27:45+00:00","first_seen_at":"2026-10-24T00:27:45+00:00","fetched_at":"2026-10-24T00:27:45+00:00","note":"CISA ICSMA-26-288-02 (2026-10-15) ties this CVE to J4Care dcm4chee-arc-light 5.35.1; fix is 5.35.2 or later. CVSS 4.0 8.7 is the AV:N/PR:N/VA:H denial-of-service vector (3.1: 7.5). No exploitation or public PoC known. I did not read the J4Care release notes, so the affected range below 5.35.1 is unknown. NVD page returned nothing; no social search done."}],"documents":[{"id":2029,"url":"https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-02","title":"CISA ICSMA-26-288-02 J4Care dcm4che","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2624,"url":"https://www.rapid7.com/db/vulnerabilities/cve-2026-101021/","title":"Rapid7: CVE-2026-101021","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}