KEVWire

Security intelligence, with context.

Response snapshot Oct 27, 2026, 16:01 UTC

Back to the wire
Permalink
VulnerabilityCVE-2026-48705

MONAILabel Server Crash and Silent Inference Corruption via Crafted DICOM (pydicom DS/IS Validation Bypass)

An unauthenticated remote attacker can crash a running MONAILabel server or silently corrupt its medical AI inference results by uploading a single crafted DICOM file (~132 KB) via the REST API.

Published Updated

At a glance

Exploited
Not known
Severity
9.3 Critical (CVSS 3.1)
Chance of exploitation
Not estimated
Sources
1 source

What to do

GitHub lists first patched versions: monai: 1.6.1. Confirm the affected range and upgrade guidance in the exact advisory.

Read GitHub-reviewed advisory GHSA-6hp3-vr39-rqw8 (opens a new tab)

What happened

### Summary

An unauthenticated remote attacker can crash a running MONAILabel server or silently corrupt its medical AI inference results by uploading a single crafted DICOM file (~132 KB) via the REST API.

The vulnerability stems from pydicom's lack of validation for Decimal String (DS) and Integer String (IS) DICOM Value Representations, which allows NaN and infinity values to pass through MONAI's PydicomReader and propagate through the entire spatial transform and ML inference pipeline.

No authentication is required for the default MONAILabel REST API. The attacker needs only network access to the server (default port 8000).

Continue reading

**Severity:** CVSS 3.1: 8.7 HIGH **CVSS Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:L **CWE:** CWE-20 (Improper Input Validation) → CWE-682 (Incorrect Calculation)

### Details

**Root Cause — Layer 1: pydicom accepts invalid VR values**

pydicom's `DSfloat.__new__()` calls Python's `float(val)`, which silently accepts "NaN", "inf", and "-inf". The DICOM standard (PS3.5 Table 6.2-1) defines DS as digits 0-9, +, -, ., e only. NaN and inf are not valid DS values. The `is_valid_ds()` check only runs in RAISE validation mode, which is NOT the default. The default mode is WARN, which still returns the invalid value.

```python >>> from pydicom.valuerep import DSfloat >>> DSfloat("NaN") nan # Accepted silently — should be rejected >>> DSfloat("inf") inf # Accepted silently — should be rejected ```

This affects ALL pydicom versions from 0.9.7 through 3.0.2 (current).

A related bypass exists in pydicom's IS type: `IS("1e4")` returns 10000 via an `int(float(val))` fallback, accepting scientific notation that is not valid per the DICOM standard.

**Root Cause — Layer 2: MONAI Core trusts pydicom output without validation**

MONAI's `PydicomReader._get_affine()` builds a 4x4 affine transformation matrix from PixelSpacing, ImagePositionPatient, and ImageOrientationPatient with ZERO `isfinite()` or `isnan()` checks. NaN in PixelSpacing produces NaN in the affine diagonal, propagating through every spatial transform: `PydicomReader._get_affine() → LoadImaged → Spacingd → Model → Writer`

**Root Cause — Layer 3: MONAILabel REST API accepts anything**

MONAILabel's `PUT /datastore/` endpoint accepts DICOM uploads with no authentication (default deployment), no validation of spatial metadata, and no bounds checking on any DICOM tag values. The malicious DICOM is stored permanently and made available for inference.

### PoC

**Environment Setup:** ```bash # Start MONAILabel (Docker) docker pull projectmonai/monailabel:latest docker run -d --name monailabel-poc -p 8000:8000 --memory=8g \ projectmonai/monailabel:latest monailabel start_server \ --app /opt/monai/sample-apps/radiology \ --studies /opt/monai/datasets/Task09_Spleen/imagesTr \ --conf models segmentation

# Verify server is running curl http://localhost:8000/info/ ```

**Step 1 — Establish baseline (legitimate data works):** ```bash curl -X POST "http://localhost:8000/infer/segmentation?image=spleen_40" \ -o baseline.nii.gz -w "HTTP %{http_code} - %{size_download} bytes" # Result: HTTP 200, ~223,628 bytes valid segmentation mask ```

**Step 2 — Run the attack (NaN DICOM upload + inference):** ```bash pip install pydicom numpy requests python poc_monailabel_ds_bypass.py --server http://localhost:8000 ```

The PoC script: 1. Confirms pydicom accepts NaN/inf in DS fields 2. 2. Creates three malicious DICOM files (~132 KB each) with NaN/inf in PixelSpacing and ImagePositionPatient 3. 3. Uploads each via `PUT /datastore/` (no auth required) — HTTP 200 accepted 4. 4. Triggers inference via `POST /infer/segmentation` — HTTP 500, server crash **Demonstrated Results:**

| Payload | Upload | Inference | Result | |---|---|---|---| | Baseline (spleen_40) | N/A | HTTP 200 | Valid 223 KB segmentation | | NaN PixelSpacing | HTTP 200 | HTTP 500 | RuntimeError crash (18.0s wasted compute) | | NaN PixelSpacing + IPP | HTTP 200 | HTTP 500 | RuntimeError crash (16.7s wasted compute) | | Inf PixelSpacing | HTTP 200 | HTTP 500 | RuntimeError crash (16.4s wasted compute) |

**Server crash traceback:** ``` monailabel/tasks/infer/basic_infer.py → self.writer(data) monailabel/transform/writer.py → write_itk(...) itk/ITKCommonBasePython.py → itkProcessObject_Update() RuntimeError: itkGDCMImageIO.cxx:1226: ITK ERROR: GDCMImageIO: A Floating point buffer was passed but the stored pixel type was not specified. ```

Each request burns ~16 seconds of server compute (full ML inference pipeline) before crashing. The NaN DICOM persists in the datastore — any future inference on that image ID crashes the server again.

**Library-level confirmation:** 17/17 test vectors confirmed against MONAI 1.5.2 and pydicom 3.0.2, including actual MONAI `LoadImaged` and `Spacingd` transforms accepting NaN geometry without error.

### Impact

1. **Denial of Service:** A single ~132 KB DICOM upload crashes the MONAILabel inference pipeline. All active inference requests from legitimate users are aborted. Repeatable indefinitely with minimal bandwidth. 2. **Silent Data Corruption:** NaN values in spatial metadata propagate through the entire ML inference pipeline and produce geometrically incorrect segmentation masks.

If the output writer does not crash, the result is returned with HTTP 200 and zero warnings. 3. **Persistent Datastore Poisoning:** The malicious DICOM is stored permanently via `PUT /datastore/`. Any future inference request on that image ID reproduces the crash or corruption, persisting across server restarts.

**Affected MONAI Ecosystem (9 repositories):** - MONAI Core: PydicomReader, LoadImaged, Spacingd transforms - - MONAILabel: REST API + DICOMweb datastore - - MONAI Deploy App SDK: DICOMDataLoaderOperator - - model-zoo, VISTA, GenerativeModels, tutorials, research-contributions **Affected DICOM Tags (any DS VR):** PixelSpacing, ImagePositionPatient, SliceThickness, ImageOrientationPatient, RescaleSlope, WindowCenter/WindowWidth

**

Affected package ranges reported by GitHub: monai: < 1.6.1

Scores and how they were measured

CVSS base severity

9.3

Version 3.1As of

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:L

Measurement source (opens a new tab)

How bad it is if exploited. Not a prediction of exploitation or proof you are exposed.

EPSS probability

Not available

A model's estimate of exploitation in the next 30 days, not certainty or your own risk.

Related technology

Sources

  1. Primary source

    GitHub-reviewed advisory GHSA-6hp3-vr39-rqw8 (opens a new tab)

    The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review.

    Published Checked

  2. Primary source

    GitHub public advisory API page (opens a new tab)

    The API page supplied GHSA-6hp3-vr39-rqw8, its actual identifiers, source dates, and structured metrics.

    Published Date not suppliedChecked

Cite this record

For factual claims, cite the primary sources above; cite KEVWire for its compilation, dates, and classifications.

APA

KEVWire. (2026, October 27). MONAILabel Server Crash and Silent Inference Corruption via Crafted DICOM (pydicom DS/IS Validation Bypass) (CVE-2026-48705). https://kevwire.com/record/CVE-2026-48705

MLA

"MONAILabel Server Crash and Silent Inference Corruption via Crafted DICOM (pydicom DS/IS Validation Bypass) (CVE-2026-48705)." KEVWire, 27 Oct. 2026, kevwire.com/record/CVE-2026-48705.

Chicago

KEVWire. "MONAILabel Server Crash and Silent Inference Corruption via Crafted DICOM (pydicom DS/IS Validation Bypass) (CVE-2026-48705)." Last modified October 27, 2026. https://kevwire.com/record/CVE-2026-48705.

Evidence summary (plain text)

MONAILabel Server Crash and Silent Inference Corruption via Crafted DICOM (pydicom DS/IS Validation Bypass) (Oct 27, 2026).
An unauthenticated remote attacker can crash a running MONAILabel server or silently corrupt its medical AI inference results by uploading a single crafted DICOM file (~132 KB) via the REST API. The vulnerability stems from pydicom's lack of validation for Decimal String (DS) and Integer String (IS) DICOM Value Representations, which allows NaN and infinity values to pass through MONAI's PydicomReader and propagate through the entire spatial transform and ML inference pipeline.

No authentication is required for the default MONAILabel REST API. The attacker needs only network access to the server (default port 8000).
CVSS 9.3 (version 3.1; evidence as of Oct 27, 2026; https://github.com/advisories/GHSA-6hp3-vr39-rqw8).
Sources:
GitHub-reviewed advisory GHSA-6hp3-vr39-rqw8: https://github.com/advisories/GHSA-6hp3-vr39-rqw8
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
Record ID: CVE-2026-48705.
Record origin: Ingested record.
AI evidence: Not assessed.
Known exploitation: Not assessed.
Zero-day status: Not assessed. KEV membership alone does not establish zero-day status.
About this data

This record was ingested from a data source. Retrieved: Oct 27, 2026, 16:00 UTC. Ingestion is not an independent editorial investigation.

A CISA KEV listing documents known exploitation, not necessarily a zero-day; absence from the catalog does not prove a vulnerability has never been exploited.

Technology tags indicate possible relevance, not verified exposure. Confirm the affected product, version, and configuration against your own inventory; KEVWire does not scan your systems.

A personal reading checklist on this device, not verified remediation.

Record JSON

Your account

Email alerts

Email alerts are not available yet. To follow your stack today, use its RSS feed, which honors your filters, or connect an AI agent through the API.

Suggest an improvement

Ideas, missing sources, corrections, and bugs are all welcome. No account needed. Suggestions are reviewed by a person before anything changes.

Record details

Record detail