CVE-2026-126421 · Package
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.5.0 accepts an unbounded count parameter in print_labels requests to labs_ajax.php. An authenticated user with patients/med access can force huge mPDF and barcode generation and make the application unavailable.
first public Oct 28, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Clinics and organizations that run OpenEMR self-hosted before 8.5.0 and have users with the patients/med permission. Exposure needs a valid login with that role; installations on 8.5.0 or later are not affected by this issue.
Not affected if no-patients-med-users, openemr-8.5.0-or-later
Who cares healthcare, openemr, php, self-hosted
8.5.0labs_ajax.php is reachable by users who hold the patients/med permission8.5.0 or laterOpenEMR before 8.5.0 contains an uncontrolled resource consumption vulnerability that allows authenticated users with patients/med access to exhaust PHP workers via an unbounded count parameter. Attackers can send print_labels requests to labs_ajax.php with huge counts, forcing mPDF page and barcode generation that makes OpenEMR unavailable.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.