CVE catalog

CVE-2021-41687

DCMTK vulnerabilities

Severity: Medium
Published: Jun 28, 2022, 1:15:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 1.79% · Oct 25, 2026

DCMTK through 3.6.6 does not handle memory free properly. The program malloc a heap memory for parsing data, but does not free it when error in parsing. Sending specific requests to the dcmqrdb program incur the memory leak. An attacker can use it to launch a DoS attack.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	dcmtk	sid	`3.7.0+really3.7.0-7`	fixed
Debian	dcmtk	forky	`3.7.0+really3.7.0-7`	fixed
Debian	dcmtk	trixie	`3.6.9-5+deb13u3`	fixed
Debian	dcmtk	bookworm	`3.6.7-9~deb12u4`	fixed
Ubuntu	dcmtk	noble	`3.6.7-9.1ubuntu0.1~esm1`	fixed
Ubuntu	dcmtk-doc	noble	`3.6.7-9.1ubuntu0.1~esm1`	fixed
Ubuntu	libdcmtk-dev	noble	`3.6.7-9.1ubuntu0.1~esm1`	fixed
Ubuntu	libdcmtk17t64	noble	`3.6.7-9.1ubuntu0.1~esm1`	fixed
Ubuntu	dcmtk	pro	`3.6.5-1`	vulnerable
Ubuntu	dcmtk	pro	`3.6.6-3ubuntu1`	vulnerable
Ubuntu	dcmtk	pro	`3.6.6-3ubuntu2`	vulnerable
Ubuntu	dcmtk	pro	`3.6.6-4`	vulnerable
Ubuntu	dcmtk	pro	`3.6.6-5`	vulnerable
Ubuntu	dcmtk	pro	`3.6.6-5ubuntu0.1~esm1`	fixed
Ubuntu	dcmtk	20.04	`3.6.4-2.1`	vulnerable
Ubuntu	dcmtk	20.04	`3.6.4-2.1build1`	vulnerable
Ubuntu	dcmtk	20.04	`3.6.4-2.1build2`	vulnerable
Ubuntu	dcmtk	20.04	`3.6.4-2.1ubuntu0.1`	fixed
Ubuntu	dcmtk	pro	`3.6.2-2`	vulnerable
Ubuntu	dcmtk	pro	`3.6.2-2build1`	vulnerable
Ubuntu	dcmtk	pro	`3.6.2-3`	vulnerable
Ubuntu	dcmtk	pro	`3.6.2-3build1`	vulnerable
Ubuntu	dcmtk	pro	`3.6.2-3build2`	vulnerable
Ubuntu	dcmtk	pro	`3.6.2-3build3`	vulnerable
Ubuntu	dcmtk	pro	`3.6.2-3ubuntu0.1~esm1`	vulnerable
Ubuntu	dcmtk	pro	`3.6.2-3ubuntu0.1~esm2`	vulnerable
Ubuntu	dcmtk	pro	`3.6.2-3ubuntu0.1~esm3`	fixed
Ubuntu	dcmtk	20.04	`3.6.4-2.1`	vulnerable
Ubuntu	dcmtk	20.04	`3.6.4-2.1build1`	vulnerable
Ubuntu	dcmtk	20.04	`3.6.4-2.1build2`	vulnerable
Ubuntu	dcmtk	20.04	`3.6.4-2.1ubuntu0.1`	vulnerable
Ubuntu	dcmtk	20.04	`3.6.4-2.1ubuntu0.2`	fixed
Ubuntu	dcmtk	pro	`3.6.7-9`	vulnerable
Ubuntu	dcmtk	pro	`3.6.7-9.1build2`	vulnerable
Ubuntu	dcmtk	pro	`3.6.7-9.1build3`	vulnerable
Ubuntu	dcmtk	pro	`3.6.7-9.1build4`	vulnerable
Ubuntu	dcmtk	pro	`3.6.7-9.1ubuntu0.1~esm1`	fixed
Ubuntu	dcmtk	20.04	`3.6.4-2.1`	vulnerable
Ubuntu	dcmtk	20.04	`3.6.4-2.1build1`	vulnerable
Ubuntu	dcmtk	20.04	`3.6.4-2.1build2`	vulnerable
Ubuntu	dcmtk	20.04	`3.6.4-2.1ubuntu0.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	dcmtk	source	sid	`3.6.7-1`	not yet assigned	Not reported	Not reported
Debian	dcmtk	source	forky	`3.6.7-1`	not yet assigned	Not reported	Not reported
Debian	dcmtk	source	trixie	`3.6.7-1`	not yet assigned	Not reported	Not reported
Debian	dcmtk	source	bookworm	`3.6.7-1`	not yet assigned	Not reported	Not reported
Ubuntu	dcmtk	deb	noble	`3.6.7-9.1ubuntu0.1~esm1`	Not reported	Not reported	Not reported
Ubuntu	dcmtk-doc	deb	noble	`3.6.7-9.1ubuntu0.1~esm1`	Not reported	Not reported	Not reported
Ubuntu	libdcmtk-dev	deb	noble	`3.6.7-9.1ubuntu0.1~esm1`	Not reported	Not reported	Not reported
Ubuntu	libdcmtk17t64	deb	noble	`3.6.7-9.1ubuntu0.1~esm1`	Not reported	Not reported	Not reported
Ubuntu	dcmtk	deb	pro	`3.6.6-5ubuntu0.1~esm1`	Not reported	UBUNTU-CVE-2021-41687	Not reported
Ubuntu	dcmtk	deb	20.04	`3.6.4-2.1ubuntu0.1`	Not reported	UBUNTU-CVE-2021-41687	Not reported
Ubuntu	dcmtk	deb	pro	`3.6.2-3ubuntu0.1~esm3`	Not reported	USN-7010-2	Not reported
Ubuntu	dcmtk	deb	20.04	`3.6.4-2.1ubuntu0.2`	Not reported	USN-7010-2	Not reported
Ubuntu	dcmtk	deb	pro	`3.6.7-9.1ubuntu0.1~esm1`	Not reported	USN-7010-1	Not reported
Ubuntu	dcmtk	deb	20.04	`3.6.4-2.1ubuntu0.1`	Not reported	USN-7010-1	Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[dcmtk]Fixed
Details (2)
- 3.6.7-9~deb12u4 · amd64 · bookworm
  Fixed · Fixed: 3.6.7-1
  usn · dcmtk · debian · bookworm; usn · dcmtk · debian · 12
- 3.6.7-9~deb12u4 · arm64 · bookworm
  Fixed · Fixed: 3.6.7-1
  usn · dcmtk · debian · bookworm; usn · dcmtk · debian · 12
[dcmtk-doc]Fixed
Source package: [dcmtk]
Details (2)
- 3.6.7-9~deb12u4 · all · bookworm
  Fixed · Fixed: 3.6.7-1
  usn · dcmtk · debian · bookworm; usn · dcmtk · debian · 12
- 3.6.7-9~deb12u4 · all · bookworm
  Fixed · Fixed: 3.6.7-1
  usn · dcmtk · debian · bookworm; usn · dcmtk · debian · 12
[libdcmtk17]Fixed
Source package: [dcmtk]
Details (2)
- 3.6.7-9~deb12u4 · amd64 · bookworm
  Fixed · Fixed: 3.6.7-1
  usn · dcmtk · debian · bookworm; usn · dcmtk · debian · 12
- 3.6.7-9~deb12u4 · arm64 · bookworm
  Fixed · Fixed: 3.6.7-1
  usn · dcmtk · debian · bookworm; usn · dcmtk · debian · 12
[libdcmtk-dev]Fixed
Source package: [dcmtk]
Details (2)
- 3.6.7-9~deb12u4 · amd64 · bookworm
  Fixed · Fixed: 3.6.7-1
  usn · dcmtk · debian · bookworm; usn · dcmtk · debian · 12
- 3.6.7-9~deb12u4 · arm64 · bookworm
  Fixed · Fixed: 3.6.7-1
  usn · dcmtk · debian · bookworm; usn · dcmtk · debian · 12

[Debian 13 (Trixie)]

[dcmtk]Fixed
Details (2)
- 3.6.9-5+deb13u2 · amd64 · trixie
  Fixed · Fixed: 3.6.7-1
  usn · dcmtk · debian · 13
- 3.6.9-5+deb13u2 · arm64 · trixie
  Fixed · Fixed: 3.6.7-1
  usn · dcmtk · debian · 13
[dcmtk-data]Fixed
Source package: [dcmtk]
Details (2)
- 3.6.9-5+deb13u2 · all · trixie
  Fixed · Fixed: 3.6.7-1
  usn · dcmtk · debian · 13
- 3.6.9-5+deb13u2 · all · trixie
  Fixed · Fixed: 3.6.7-1
  usn · dcmtk · debian · 13
[dcmtk-doc]Fixed
Source package: [dcmtk]
Details (2)
- 3.6.9-5+deb13u2 · all · trixie
  Fixed · Fixed: 3.6.7-1
  usn · dcmtk · debian · 13
- 3.6.9-5+deb13u2 · all · trixie
  Fixed · Fixed: 3.6.7-1
  usn · dcmtk · debian · 13
[libdcmtk19]Fixed
Source package: [dcmtk]
Details (2)
- 3.6.9-5+deb13u2 · amd64 · trixie
  Fixed · Fixed: 3.6.7-1
  usn · dcmtk · debian · 13
- 3.6.9-5+deb13u2 · arm64 · trixie
  Fixed · Fixed: 3.6.7-1
  usn · dcmtk · debian · 13
[libdcmtk-dev]Fixed
Source package: [dcmtk]
Details (2)
- 3.6.9-5+deb13u2 · amd64 · trixie
  Fixed · Fixed: 3.6.7-1
  usn · dcmtk · debian · 13
- 3.6.9-5+deb13u2 · arm64 · trixie
  Fixed · Fixed: 3.6.7-1
  usn · dcmtk · debian · 13

Observed: Oct 23, 2026, 6:02:55 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Ubuntu Security Notices (USN)]