MONAILabel: Unauthenticated DICOM Upload Can Crash Servers or Silently Corrupt AI Inference Results

What happened

A newly disclosed GitHub Security Advisory (GHSA-6hp3-vr39-rqw8, assigned CVE-2026-48705) describes a vulnerability chain affecting the MONAI medical-imaging AI ecosystem. The advisory text cites a CVSS 3.1 base score of 8.7 (HIGH); GitHub's advisory metadata lists 9.3. According to the advisory, pydicom (versions 0.9.7 through the current 3.0.2) fails to validate DICOM Decimal String (DS) and Integer String (IS) value representations. It silently accepts invalid values like NaN and inf where the DICOM standard permits only numeric digits, signs, decimals, and exponents.

The advisory states that MONAI's PydicomReader._get_affine() builds spatial transformation matrices from tags like PixelSpacing and ImagePositionPatient without any isfinite() or isnan() checks, so these invalid values propagate unchecked into the imaging pipeline. In MONAILabel specifically, the default REST API's PUT /datastore/ endpoint accepts DICOM uploads with no authentication and no validation of spatial metadata, per the report. The researcher's PoC claims a single ~132 KB crafted DICOM file, uploaded and then referenced in an inference request, reliably crashes the server (HTTP 500, ITK/GDCM error) after consuming roughly 16 to 18 seconds of inference compute. The advisory adds that the malformed file persists in the datastore and repeats the crash on future requests.

Why it matters for defenders

The advisory lists nine affected repositories in the MONAI ecosystem, including MONAI Core, MONAILabel, MONAI Deploy App SDK, model-zoo, VISTA, and GenerativeModels. Two distinct impact paths are described. The first is an unauthenticated, repeatable denial-of-service against inference servers. The second is a quieter data-integrity failure mode where NaN-poisoned geometry produces a segmentation result that is returned with HTTP 200 and no warning. In that case a clinical or research pipeline could receive a geometrically wrong AI output with no indication anything went wrong. Any organization running MONAILabel's default radiology server configuration, which the advisory notes requires no authentication on port 8000, is exposed to anyone with network access to that port.

What defenders should watch for now

• Inventory any MONAILabel, MONAI Deploy, or model-zoo deployments reachable on the network, and confirm whether authentication has been layered in front of the default REST API.
• Watch for repeated HTTP 500 errors from inference endpoints correlated with recent PUT /datastore/ uploads, and for ITK/GDCM runtime errors in server logs referencing floating-point buffer or pixel type mismatches.
• Flag unusually small (~100 to 150 KB) DICOM uploads followed immediately by inference requests as a potential probe or attack pattern.
• Where feasible, validate DS/IS-typed DICOM tags (PixelSpacing, ImagePositionPatient, SliceThickness, ImageOrientationPatient, RescaleSlope, WindowCenter/WindowWidth) for finite numeric values before they reach spatial transform code, per the advisory's recommended mitigations.
• Treat any previously accepted datastore entries as potentially poisoned if the server has been internet- or network-exposed. Re-validation of stored studies may be warranted.

Developing intel

This is a same-day advisory and the full patch landscape across the nine affected MONAI-ecosystem repositories, plus the upstream pydicom fix, is still taking shape as of this writing. Details here are drawn directly from the GitHub Security Advisory. Treat specifics as preliminary until vendor patches and CVE record details are finalized. Full technical details, the proof-of-concept, and the researcher's writeup are available at the original GHSA advisory.