GHSA-6hp3-vr39-rqw8 - MONAILabel Server Crash and Silent Inference Corruption via Crafted DICOM (pydicom DS/IS Validation Bypass)

### Summary An unauthenticated remote attacker can crash a running MONAILabel server or silently corrupt its medical AI inference results by uploading a single crafted DICOM file (~132 KB) via the REST API. The vulnerability stems from pydicom's lack of validation for Decimal String (DS) and Integer String (IS) DICOM Value Representations, which allows NaN and infinity values to pass through MONAI's PydicomReader and propagate through the entire spatial transform and ML inference pipeline. No authentication is required for the default MONAILabel REST API. The attacker needs only network access to the server (default port 8000). **Severity:** CVSS 3.1: 8.7 HIGH **CVSS Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:L **CWE:** CWE-20 (Improper Input Validation) → CWE-682 (Incorrect Calculation) ### Details **Root Cause — Layer 1: pydicom accepts invalid VR values** pydicom's `DSfloat.__new__()` calls Python's `float(val)`, which silently accepts "NaN", "inf", and "-inf". The DICOM standard (PS3.5 Table 6.2-1) defines DS as digits 0-9, +, -, ., e only. NaN and inf are not valid DS values. The `is_valid_ds()` check only runs in RAISE validation mode, which is NOT the default. The default mode is WARN, which still returns the invalid value. ```python >>> from pydicom.valuerep import DSfloat >>> DSfloat("NaN") nan # Accepted silently — should be rejected >>> DSfloat("inf") inf # Accepted silently — should be rejected ``` This affects ALL pydicom versions from 0.9.7 through 3.0.2 (current). A related bypass exists in pydicom's IS type: `IS("1e4")` returns 10000 via an `int(float(val))` fallback, accepting scientific notation that is not valid per the DICOM standard. **Root Cause — Layer 2: MONAI Core trusts pydicom output without validation** MONAI's `PydicomReader._get_affine()` builds a 4x4 affine transformation matrix from PixelSpacing, ImagePositionPatient, and ImageOrientationPatient with ZERO `isfinite()` or `isnan()` checks. NaN in PixelSpa