---
id: "CVE-2026-101021"
kind: "vulnerability"
aliases: ["CVE-2026-101021"]
title: "MultipartInputStream: crafted upload forces slow boundary matching and copying"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "dcm4chee-arc-light", "fixed": ["5.35.2"], "affected": "5.35.1", "ecosystem": "vendor"}]
ecosystems: []
tags: ["dcm4che", "dcm4chee-arc-light", "dos", "healthcare", "java", "multipart-parsing", "package", "self-hosted"]
not_affected_if: ["no-multipart-uploads", "not-internet-exposed"]
published_at: "2026-10-16T15:16:58+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-24T00:27:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101021", "first_seen_at": "2026-10-23T21:57:13+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-24T00:27:45+00:00"}]
---

# MultipartInputStream: crafted upload forces slow boundary matching and copying

dcm4chee-arc-light (J4Care DICOM archive) 5.35.1 has a MultipartInputStream that matches boundaries inefficiently and copies buffers unnecessarily. An unauthenticated remote attacker can send crafted multipart input to burn CPU and cause denial of service. The same CISA advisory lists five other dcm4chee-arc-light CVEs, all fixed in 5.35.2.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:dcm4chee-arc-light affected 5.35.1 fixed 5.35.2

## How to check

Check the running dcm4chee-arc-light version (archive UI or deployment image tag). 5.35.1 is confirmed affected; versions before 5.35.1 are unknown. Check whether the archive's REST/web endpoints are reachable from untrusted networks.

## Fix

Upgrade dcm4chee-arc-light to 5.35.2 or later. Until then, do not expose the archive to the internet and put it behind a firewall or VPN, as CISA advises.

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101021
- 2026-10-24T00:27:45+00:00 analyst — CISA ICSMA-26-288-02 (2026-10-15) ties this CVE to J4Care dcm4chee-arc-light 5.35.1; fix is 5.35.2 or later. CVSS 4.0 8.7 is the AV:N/PR:N/VA:H denial-of-service vector (3.1: 7.5). No exploitation or public PoC known. I did not read the J4Care release notes, so the affected range below 5.35.1 is unknown. NVD page returned nothing; no social search done.

## Documents

- [advisory] CISA ICSMA-26-288-02 J4Care dcm4che https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-02
- [mentions] Rapid7: CVE-2026-101021 https://www.rapid7.com/db/vulnerabilities/cve-2026-101021/

## From the sources

MultipartInputStream performs inefficient boundary matching and unnecessary buffer copying. Crafted multipart input can force excessive boundary comparisons and repeated copying.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_