PT-2026-146707
CVE-2026-126421
·
Published
2026-11-13
·
Updated
2026-11-13
Description by
CVSS 3.1
4.3
MediumMetricsAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
OpenEMR before 8.5.0 contains an uncontrolled resource consumption vulnerability that allows authenticated users with patients/med access to exhaust PHP workers via an unbounded count parameter. Attackers can send print labels requests to labs ajax.php with huge counts, forcing mPDF page and barcode generation that makes OpenEMR unavailable.
Found an issue in the description? Have something to add? Feel free to write us 👾