CVE-2026-5438

CVE-2026-5438 is a gzip decompression bomb vulnerability affecting Orthanc that exploits insufficient memory controls during HTTP request processing. When the server receives requests with gzip-encoded content, it fails to enforce limits on decompressed data size and instead allocates memory based on attacker-controlled compression metadata, allowing a specially crafted payload to trigger excessive memory consumption and system resource exhaustion. The vulnerability carries a HIGH severity rating with a CVSS score of 7.5, reflecting an unauthenticated network-based attack vector with low complexity and no special user interaction required. The attack has a high availability impact as successful exploitation can exhaust system memory and cause denial of service, though it does not affect confidentiality or integrity. There is currently no evidence of active exploitation in the wild, as CVE-2026-5438 is not listed on the Known Exploited Vulnerabilities catalog and shows no inclusion on threat actor hot lists. The vulnerability maintains a moderate FAUCET Risk Score of 47.0 and represents a below-average concern relative to other CVEs, suggesting limited immediate community attention, though the availability impact warrants timely patching for affected Orthanc deployments.