MONAILabel: Remote Denial of Service and Inference Corruption (CVE-2026-48705)

MONAILabel and MONAI Core are vulnerable to input validation flaws originating from pydicom's failure to reject non-numeric values in Decimal String (DS) DICOM fields. An unauthenticated attacker can upload malformed DICOM files (approx. 132 KB) via the REST API, which are then persisted in the datastore. These invalid values (NaN/inf) propagate through spatial transforms in the MONAI inference pipeline, resulting in server crashes (Denial of Service) or the generation of geometrically incorrect AI inference results. The issue affects MONAI versions prior to 1.6.1 and pydicom versions 0.9.7 through 3.0.2.

Attack Chain

1. Attacker identifies a target MONAILabel server with an exposed REST API (default port 8000).
2. Attacker crafts a DICOM file with NaN or infinity values injected into mandatory spatial DS tags (e.g., PixelSpacing, ImagePositionPatient).
3. Attacker submits the crafted file to the server's PUT /datastore/ endpoint without requiring authentication.
4. The MONAILabel server stores the malicious DICOM file in its permanent datastore.
5. Attacker triggers a standard inference request via POST /infer/ targeting the stored malicious image ID.
6. The MONAI PydicomReader and downstream transforms (LoadImaged/Spacingd) process the NaN/inf values without validation.
7. The inference pipeline crashes with a RuntimeError or produces corrupted AI output depending on the transform stage.

Impact

• Denial of Service: Repeated crashes of the inference service consuming server CPU and memory.
• Data Corruption: Silent production of incorrect AI segmentation masks when the pipeline does not immediately crash.
• Persistence: Malicious DICOM files remain in the datastore, causing recurrent failures upon future inference requests.

Recommendation

• Patch MONAILabel and MONAI Core to version 1.6.1 or later immediately.
• Implement strict input validation for spatial metadata on all API-exposed upload endpoints before storing files.
• Restrict network access to the MONAILabel REST API to authorized internal networks only.
• Implement Authentication and Authorization (RBAC) for all MONAILabel API endpoints to prevent unauthenticated uploads.
• Deploy monitoring for RuntimeError and itkGDCMImageIO related exceptions in inference server logs.