{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "incident": {
    "id": "cve-2026-48705",
    "url": "https://cveboard.org/i/cve-2026-48705",
    "urlPt": "https://cveboard.org/pt/i/cve-2026-48705",
    "json": "https://cveboard.org/i/cve-2026-48705.json",
    "kind": "vuln",
    "live": true,
    "knownExploited": false,
    "severity": "critical",
    "title": "MONAILabel Server Crash and Silent Inference Corruption via Crafted DICOM (pydicom DS/IS Validation Bypass)",
    "summary": "An unauthenticated remote attacker can crash a running MONAILabel server or silently corrupt its medical AI inference results by uploading a single crafted DICOM file (~132 KB) via the REST API. The vulnerability stems from pydicom's lack of validation for Decimal String (DS) and Integer String (IS) DICOM Value Representations, which allows NaN and infinity values to pass through MONAI's…",
    "titlePt": "Crash do servidor MONAILabel e corrupção silenciosa de inferência via DICOM manipulado (contorno de validação DS/IS do pydicom)",
    "summaryPt": "Um atacante remoto não autenticado pode fazer com que um servidor MONAILabel em execução pare de funcionar ou corrompa silenciosamente seus resultados de inferência de IA médica ao enviar um único arquivo DICOM manipulado (~132 KB) via a API REST. A vulnerabilidade decorre da falta de validação do pydicom para Representações de Valores DICOM Decimal String (DS) e Integer String (IS), o que permite que valores NaN e infinito passem pelo MONAI…",
    "affected": [],
    "omitted": 0,
    "references": [],
    "cwes": [],
    "ssvc": null,
    "fix": "listed",
    "tags": [
      "pip"
    ],
    "cves": [
      "CVE-2026-48705"
    ],
    "ghsa": "GHSA-6hp3-vr39-rqw8",
    "cvss": {
      "score": 9.3,
      "version": "3.1",
      "by": "GitHub"
    },
    "epss": null,
    "packages": [
      {
        "ecosystem": "pip",
        "name": "monai",
        "vulnerable": "< 1.6.1",
        "fixed": "1.6.1",
        "advisory": "GHSA-6hp3-vr39-rqw8"
      }
    ],
    "vendor": null,
    "product": null,
    "kev": null,
    "breach": null,
    "retracted": false,
    "sources": [
      {
        "label": "GitHub Advisory Database",
        "url": "https://github.com/advisories/GHSA-6hp3-vr39-rqw8"
      }
    ],
    "cvePending": false,
    "publishedAt": "2026-10-27T13:30:10.000Z",
    "updatedAt": "2026-10-27T13:30:10.000Z"
  },
  "live": true,
  "events": [
    {
      "id": "ghsa:GHSA-6hp3-vr39-rqw8:ghsa_published:2026-10-27T13:30:10.000Z",
      "incidentId": "cve-2026-48705",
      "type": "ghsa_published",
      "at": "2026-10-27T13:30:10.000Z",
      "detail": {
        "ghsa": "GHSA-6hp3-vr39-rqw8",
        "severity": "critical",
        "fixed": "1.6.1"
      }
    }
  ]
}