Security readout for executives and security teams
Plain-English summary
DCMTK through 3.6.6 has a memory leak in the dcmqrdb program. A remote party sending specific requests can make memory consumption grow during parsing errors, potentially causing service degradation or denial of service.
Executive priority
Treat this as a service availability risk. Prioritize remediation for systems supporting clinical imaging workflows or any dcmqrdb service reachable by untrusted networks.
Technical view
The issue is improper heap memory release during data parsing in dcmqrdb. Allocated memory is not freed when parsing errors occur. The public record points to DCMTK through 3.6.6, an upstream commit, and Debian LTS security updates.
Likely exposure
Exposure is most relevant where DCMTK's dcmqrdb component is deployed and reachable over a network. The bundle does not provide normalized CPEs or a complete affected product matrix.
Exploitation context
The CVE description says crafted requests can trigger the leak and support a DoS attack. The source bundle does not show KEV listing or cited evidence of active exploitation.
Researcher notes
Evidence is limited but consistent: CVE text identifies a memory leak on parsing error, the affected component, and DoS impact. No CVSS, CWE, CPE, or active exploitation evidence is provided in the bundle.
Mitigation direction
- Check vendor and distribution guidance for fixed DCMTK packages.
- Upgrade DCMTK if running version 3.6.6 or earlier.
- Apply Debian LTS dcmtk security updates where applicable.
- Restrict network access to dcmqrdb to trusted systems.
- Monitor affected services for abnormal memory growth.
Validation and detection
- Inventory hosts for DCMTK and dcmqrdb usage.
- Confirm deployed DCMTK versions are newer than 3.6.6 or vendor-fixed.
- Verify Debian systems include the referenced dcmtk security update.
- Review service exposure for dcmqrdb network reachability.
- Check monitoring history for unexplained memory growth or service restarts.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-41687 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/DCMTK/dcmtkCVE reference
- https://github.com/DCMTK/dcmtk/commit/a9697dfeb672b0b9412c00c7d36d801e27ec85cbCVE reference
- [debian-lts-announce] 20240628 [SECURITY] [DLA 3847-1] dcmtk security updateCVE reference · mailing-list
- https://lists.debian.org/debian-lts-announce/2025/01/msg00032.htmlCVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.