{"id":"CVE-2026-107621","kind":"vulnerability","aliases":["CVE-2026-107621"],"related":[],"title":"JPEGParser: crafted or truncated JPEG stream causes infinite loop","description":"JPEGParser can enter an infinite loop while parsing a specially crafted or truncated stream.","summary":"The JPEGParser in J4Care dcm4chee-arc-light (a DICOM medical image archive) can loop forever on a crafted or truncated JPEG stream. A remote unauthenticated sender can pin CPU and make the archive unresponsive (CWE-835). It is one of six flaws fixed together in 5.35.2.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"dcm4chee-arc-light","fixed":["5.35.2"],"affected":"5.35.1","ecosystem":"vendor"}],"ecosystems":[],"tags":["dcm4chee","denial-of-service","dicom","healthcare","java","jpeg","package","parsing","python","self-hosted"],"not_affected_if":["no-untrusted-jpeg-input","not-network-exposed"],"how_to_check":"Check the installed dcm4chee-arc-light version (archive UI or deployment image tag). 5.35.1 is affected per CISA; earlier versions are not confirmed either way. Exposed if the archive accepts DICOM or upload traffic from untrusted networks.","fix":"Upgrade dcm4chee-arc-light to 5.35.2 or later (J4Care's fix per CISA ICSMA-26-288-02). Until then, keep the archive off the internet and behind a firewall or VPN.","status":"open","published_at":"2026-10-16T15:17:05+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-23T22:39:06+00:00","updated_at":"2026-10-24T00:26:43+00:00","category":"package","confidence":0.75,"triage":{"at":"2026-10-23T22:39:06Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"JPEGParser: crafted or truncated JPEG stream causes infinite loop","impact":"low","summary":"JPEGParser, a JPEG parsing component, can enter an infinite loop when it reads a specially crafted or truncated stream. An attacker who supplies such a file can hang the process that parses it, causing denial of service.","category":"package","who_cares":["jpeg","python","parsing"],"confidence":0.35,"needs_auth":"unknown","worst_case":"parser hangs forever on a crafted file, stalling the service","analyst_note":"Identify the affected package and versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-107621, then find the fixed release.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-untrusted-jpeg-input"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000456,"input_tokens":2836,"output_tokens":345,"severity_before":"high"},"analyst_status":"done","analyst_note":"Identify the affected package and versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-107621, then find the fixed release.","search":"'-107621':12A,15A '-2026':11A,14A '-835':71B '5.35.2':81B 'arc':18A,41B 'archiv':47B,68B 'caus':7A 'cpu':64B 'craft':2A,53B,92C 'cve':10A,13A 'cwe':70B 'dcm4chee':17A,20B,40B 'dcm4chee-arc-light':16A,39B 'denial':22B 'denial-of-servic':21B 'dicom':25B,44B 'enter':84C 'fix':78B 'flaw':77B 'forev':50B 'healthcar':26B 'host':34B 'imag':46B 'infinit':8A,86C 'j4care':38B 'java':27B 'jpeg':5A,28B,56B 'jpegpars':1A,36B,82C 'light':19A,42B 'loop':9A,49B,87C 'make':66B 'medic':45B 'one':74B 'packag':29B 'pars':30B,89C 'pin':63B 'python':31B 'remot':59B 'self':33B 'self-host':32B 'sender':61B 'servic':24B 'six':76B 'special':91C 'stream':6A,57B,95C 'togeth':79B 'truncat':4A,55B,94C 'unauthent':60B 'unrespons':69B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T15:17:05+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"ics-cert@hq.dhs.gov","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107621","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107621","severity":null,"published_at":"2026-10-16T15:17:05+00:00","modified_at":"2026-10-16T20:04:29+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-107621:662","url":null,"severity":null,"published_at":"2026-10-24T00:26:43+00:00","modified_at":"2026-10-24T00:26:43+00:00","first_seen_at":"2026-10-24T00:26:43+00:00","fetched_at":"2026-10-24T00:26:43+00:00","note":"Product is J4Care dcm4chee-arc-light (Java DICOM archive), not a Python package; CISA ICSMA-26-288-02 lists 5.35.1 affected, fix 5.35.2 or later. No exploitation reported; no PoC found. Did not find J4Care's own release page, so upper bound of affected range (earlier versions) is unverified. Skipped social search (niche)."}],"documents":[{"id":2029,"url":"https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-02","title":"CISA ICSMA-26-288-02 J4Care dcm4che","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2610,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107621","title":"NVD CVE-2026-107621","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}