CVE-2026-101021
validatedZero produced an exploit or a check.description
dcm4chee-arc-light includes multipart input handling with inefficient boundary matching and buffer copying. An attacker able to submit crafted multipart requests may cause excessive CPU or memory consumption. Exploitation requires access to an endpoint that accepts multipart input.
mitigation
Restrict access to multipart-accepting endpoints and enforce request-size and request-time limits where available. Monitor for an upstream update and apply it when a fixed release is published.
outcome
Check only, differential: the check fires on the vulnerable build and is silent on the patched one.
source signals
Public signals that triggered or updated the pipeline. These are inputs for the deltas above.
- 2026-10-16 14:28Zcve_org: trigger signal, started the run
this entry in the feed
GET /api/v1/feed/CVE-2026-101021
{ "etk_id": "ETK-2026-1782", "cve_id": "CVE-2026-101021", "display_id": "CVE-2026-101021", "ghsa_id": null, "euvd_id": "EUVD-2026-102893", "status": "published", "anchor_state": "anchored", "title": "Inefficient multipart parsing in dcm4chee-arc-light", "summary": "dcm4chee-arc-light includes multipart input handling with inefficient boundary matching and buffer copying. An attacker able to submit crafted multipart requests may cause excessive CPU or memory consumption. Exploitation requires access to an endpoint that accepts multipart input.", "mitigation": "Restrict access to multipart-accepting endpoints and enforce request-size and request-time limits where available. Monitor for an upstream update and apply it when a fixed release is published.", "vendor": "J4Care", "product": "dcm4chee-arc-light", "affected": [ { "affected_notes": [], "affected_ranges": [ "5.35.1" ], "ecosystem": null, "fixed_versions": [], "package_name": "dcm4chee-arc-light", "purl": null } ], "cwes": [ 407 ], "cvss_score": 8.7, "cvss_src": "cna_vendor", "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "epss_score": 0.0034, "epss_percentile": 0.2643, "epss_asof": "2026-10-20", "automation": "deterministic", "check": true, "check_confidence_basis": "differential", "exploit": false, "pipeline_minutes": 25.457899866666665, "t0_at": "2026-10-16T14:28:54.992000+00:00", "signals": { "check": { "at": "2026-10-16T15:37:12.877942+00:00", "days": 0.04742923543981482, "is_lower_bound": false, "measured_at": "2026-10-16T14:28:54.992000+00:00", "url": null }, "trigger_signal": { "at": "2026-10-16T14:28:54.992000+00:00", "days": 0, "is_lower_bound": false, "measured_at": "2026-10-16T14:28:54.992000+00:00", "url": "https://www.cve.org/CVERecord?id=CVE-2026-101021" } } }
published 2026-10-16 15:11Z
last change 2026-10-21 05:31Z
Need the technical details behind an entry?
Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.