CVE-2025-14501CWE-476

CVE-2025-14501

High · published December 24, 2025

CVSS v3.0
7.5
EPSS
1%
Percentile
54.9
In the wild
Unconfirmed
What it is

🚨 A NULL pointer mishap in Sante PACS Server can turn your system into a digital paperweight! ⚡ Think of it like a restaurant with a faulty reservation system — one wrong entry can crash the whole dining experience, leaving guests out in the cold. In this case, an attacker can exploit the mishandling of the HTTP Content-Length header to bring your server to its knees. An attacker could trigger a denial-of-service condition, meaning your PACS Server could go offline completely, preventing access to critical medical images and dashing your healthcare services. This could disrupt operations, cause frustration, and potentially jeopardize patient care — absolutely devastating!

Put simply

Think of it like a restaurant with a faulty reservation system — one wrong entry can crash the whole dining experience, leaving guests out in the cold. In this case, an attacker can exploit the mishandling of the HTTP Content-Length header to bring your server to its knees. This vulnerability occurs due to inadequate validation of a pointer when handling the HTTP Content-Length header, allowing remote attackers to exploit it, even without authentication, to crash the server.

What to do

An attacker could trigger a denial-of-service condition, meaning your PACS Server could go offline completely, preventing access to critical medical images and dashing your healthcare services. This could disrupt operations, cause frustration, and potentially jeopardize patient care — absolutely devastating! To remedy this issue, ensure you patch Sante PACS Server to the latest version as soon as possible. Regularly audit your server configurations and validate HTTP headers to prevent similar issues in the future. Don't wait for downtime to take action! You've got this! With these steps, you'll be back on track in no time, keeping your systems secure and operational! 🛡️

The record
Technical detail
CVSS v3.0
7.5 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00764 · 54.9th percentile
Weakness
CWE-476 · NULL Pointer Dereference
Published
2025-12-24T03:15Z
References (1)
EPSS history
Timeline
  • 23 DEC 21:18Z
    Sante PACS Server HTTP Content-Length Header Handling NULL Pointer Dereference Denial-of-Service Vulnerability
    cvelistv5