Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-g3fh-up2y-qub7
Vulnerability ID VCID-g3fh-up2y-qub7
Aliases CVE-2021-41690
Summary DCMTK through 3.6.6 does not handle memory free properly. The malloced memory for storing all file information are recorded in a global variable LST and are not freed properly. Sending specific requests to the dcmqrdb program can incur a memory leak. An attacker can use it to launch a DoS attack.
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk None
Affected and Fixed Packages Package Details
Weaknesses (0)
There are no known CWE.
System Score Found at
epss 0.0014 https://api.first.org/data/v1/epss?cve=CVE-2021-41690
epss 0.0014 https://api.first.org/data/v1/epss?cve=CVE-2021-41690
ssvc Track https://github.com/DCMTK/dcmtk
ssvc Track https://github.com/DCMTK/dcmtk/commit/a9697dfeb672b0b9412c00c7d36d801e27ec85cb
ssvc Track https://lists.debian.org/debian-lts-announce/2024/06/msg00022.html
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2021-41690
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41690
a9697dfeb672b0b9412c00c7d36d801e27ec85cb https://github.com/DCMTK/dcmtk/commit/a9697dfeb672b0b9412c00c7d36d801e27ec85cb
dcmtk https://github.com/DCMTK/dcmtk
msg00022.html https://lists.debian.org/debian-lts-announce/2024/06/msg00022.html
USN-5882-1 https://usn.ubuntu.com/5882-1/
USN-7010-1 https://usn.ubuntu.com/7010-1/
No exploits are available.
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-07-09T18:13:18Z/ Found at https://github.com/DCMTK/dcmtk
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-07-09T18:13:18Z/ Found at https://github.com/DCMTK/dcmtk/commit/a9697dfeb672b0b9412c00c7d36d801e27ec85cb
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-07-09T18:13:18Z/ Found at https://lists.debian.org/debian-lts-announce/2024/06/msg00022.html
Exploit Prediction Scoring System (EPSS)
Percentile 0.3384
EPSS Score 0.0014
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T17:32:52.340802+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2021/41xxx/CVE-2021-41690.json 38.6.0