CVE-2026-126421
Awaiting Analysis Awaiting Analysis - Queue

Uncontrolled Resource Consumption in OpenEMR

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
OpenEMR before 8.5.0 contains an uncontrolled resource consumption vulnerability that allows authenticated users with patients/med access to exhaust PHP workers via an unbounded count parameter. Attackers can send print_labels requests to labs_ajax.php with huge counts, forcing mPDF page and barcode generation that makes OpenEMR unavailable.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-126421
EUVD
EUVD-2026-125022

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openemr openemr to 8.5.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

OpenEMR before version 8.5.0 has a vulnerability where authenticated users with patients/med access can send requests with an unbounded count parameter to labs_ajax.php. This triggers excessive page and barcode generation via mPDF, consuming PHP workers and causing a denial of service.

Detection Guidance

Monitor for unusually high CPU or memory usage on the OpenEMR server, particularly during PDF generation tasks. Check Apache/Nginx logs for repeated requests to labs_ajax.php with extremely large count parameters. Use tools like netstat or ss to identify excessive connections to the OpenEMR service.

Impact Analysis

This vulnerability can make OpenEMR unavailable by exhausting PHP worker resources. Attackers can crash the system or cause timeouts, disrupting normal operations for all users. The attack requires only standard medical-record permissions.

Mitigation Strategies

Upgrade OpenEMR to version 8.5.0 or later immediately. Implement rate limiting on the labs_ajax.php endpoint to prevent excessive requests. Add input validation to enforce a maximum limit on the count parameter in print_labels requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-126421. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...