---
id: "CVE-2026-105667"
kind: "vulnerability"
aliases: ["CVE-2026-105667"]
title: "HL7 listener accepts unauthenticated patient-merge messages, reassigning records"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "dcm4chee-arc-light", "fixed": ["5.35.2"], "affected": "5.35.1", "ecosystem": "vendor"}]
ecosystems: []
tags: ["dcm4chee", "dicom", "healthcare-imaging", "hl7", "other", "pacs", "self-hosted"]
not_affected_if: ["listener-restricted-to-trusted-senders", "non-default-config", "version-5.35.2-or-later"]
published_at: "2026-10-16T15:17:04+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-24T00:26:53+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105667", "first_seen_at": "2026-10-23T21:57:13+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-24T00:26:53+00:00"}]
---

# HL7 listener accepts unauthenticated patient-merge messages, reassigning records

J4Care dcm4chee-arc-light 5.35.1 (open-source DICOM/PACS archive). In the default configuration the HL7 listener (ports 2575 and 12575 TLS) accepts ADT^A40 patient-merge messages without authenticating the sending application. A remote sender can reassign studies and workflow records between patients, and the archive's unmerge does not undo it. One of six CVEs in CISA ICSMA-26-288-02. No known exploitation.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:dcm4chee-arc-light affected 5.35.1 fixed 5.35.2

## How to check

Check the version: 5.35.1 is affected. In the archive UI go to Configuration > Devices > dcm4chee-arc > HL7 Applications, and check whether 'Validate Sending HL7 Application Hostname' (hl7ValidateSendingApplicationHostname) is set and the sending apps are listed with their connections. The default pre-configured '*' HL7 application accepts any sender. Check whether ports 2575 and 12575 are reachable from untrusted networks. Audit past ADT^A40 merges against the upstream registration system.

## Fix

Upgrade to dcm4chee-arc-light 5.35.2 or later (Docker tag dcm4che/dcm4chee-arc-psql:5.35.2). Then enable 'Validate Sending HL7 Application Hostname' at Archive Device or HL7 Application level and register only the legitimate sending applications and hosts. Also restrict the HL7 ports to trusted senders at the network layer.

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-105667
- 2026-10-24T00:26:53+00:00 analyst — Product is J4Care dcm4chee-arc-light 5.35.1 (CISA ICSMA-26-288-02, CNA ICS-CERT); fix 5.35.2 per CISA. Setting hl7ValidateSendingApplicationHostname from release item #5066 is likely the control, but no source explicitly ties it to this CVE and the release notes do not list this CVE under Fixed Security Advisories; whether 5.35.2 turns it on by default is unknown. No exploitation or public PoC found (CISA says none); X has about 3 posts in 7 days, none saved.

## Documents

- [advisory] CISA ICSMA-26-288-02 J4Care dcm4che https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-02
- [describes] Severity Daily: dcm4chee archive accepts unauthenticated DICOM and HL7 by default https://severitydaily.com/dcm4chee-arc-light-icsma-26-288-02-six-cves-unauthenticated-dicom-hl7-merge-not-reversible-5-35-2/
- [fix] dcm4chee-arc-light 5.35.2 release notes https://newreleases.io/project/github/dcm4che/dcm4chee-arc-light/release/5.35.2
- [mitigation] Validate Hostname or IP Address of Sending HL7 Application (#5066) https://github.com/dcm4che/dcm4chee-arc-light/issues/5066

## From the sources

In the default configuration, the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending application. A remote sender can reassign studies and related workflow records from one patient identity to another. The archive's unmerge does not reverse this.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_