{"id":"CVE-2026-126423","kind":"vulnerability","aliases":["CVE-2026-126423"],"related":[],"title":"OpenEMR: crafted ZIP uploads exhaust memory and make the app unavailable","description":"OpenEMR before 8.5.0 contains a denial of service vulnerability in four ZIP upload paths that read uncompressed entries into memory without size or ratio checks. Authenticated billing or Carecoordination users can upload highly compressed ZIP archives to exhaust PHP memory and worker pools, making OpenEMR unavailable.","summary":"OpenEMR before 8.5.0 reads uncompressed ZIP entries into memory in four upload paths without size or ratio checks. An authenticated billing or care-coordination user can upload a highly compressed archive to exhaust PHP memory and worker pools, making the system unavailable.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["healthcare","openemr","php","runtime","self-hosted"],"not_affected_if":["no-billing-or-carecoordination-users","openemr-8.5.0-or-later"],"how_to_check":"- Check the OpenEMR version in the installed application; versions below `8.5.0` are in scope.\n- Confirm whether billing or Carecoordination users can upload files to the ZIP upload paths.","fix":"- OpenEMR `8.5.0` or later, per the advisory.","status":"open","published_at":"2026-11-13T10:17:48+00:00","first_seen_at":"2026-11-13T10:47:21+00:00","triaged_at":"2026-11-13T10:57:17+00:00","updated_at":"2026-11-13T10:57:17+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-13T10:57:17Z","model":"claude-haiku-5-5","output":{"fix":"- OpenEMR `8.5.0` or later, per the advisory.","reach":"network","title":"OpenEMR: crafted ZIP uploads exhaust memory and make the app unavailable","impact":"medium","summary":"OpenEMR before 8.5.0 reads uncompressed ZIP entries into memory in four upload paths without size or ratio checks. An authenticated billing or care-coordination user can upload a highly compressed archive to exhaust PHP memory and worker pools, making the system unavailable.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["openemr","php","self-hosted","healthcare"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Application becomes unavailable through memory and worker exhaustion","analyst_note":"","how_to_check":"- Check the OpenEMR version in the installed application; versions below `8.5.0` are in scope.\n- Confirm whether billing or Carecoordination users can upload files to the ZIP upload paths.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["openemr-8.5.0-or-later","no-billing-or-carecoordination-users"],"who_is_affected":"Sites running OpenEMR before 8.5.0 where authenticated users in the billing or Carecoordination roles can upload files. Exposure depends on those roles having upload access; the sources do not say more.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000733,"input_tokens":4613,"output_tokens":544,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126423':14A,17A '-2026':13A,16A '8.5.0':27B,70C 'app':10A 'archiv':56B,103C 'authent':44B,93C 'bill':45B,94C 'care':48B 'care-coordin':47B 'carecoordin':96C 'check':42B,92C 'compress':55B,101C 'contain':71C 'coordin':49B 'craft':2A 'cve':12A,15A 'denial':73C 'entri':31B,85C 'exhaust':5A,58B,105C 'four':35B,78C 'healthcar':18B 'high':54B,100C 'host':24B 'make':8A,64B,111C 'memori':6A,33B,60B,87C,107C 'openemr':1A,19B,25B,68C,112C 'path':37B,81C 'php':20B,59B,106C 'pool':63B,110C 'ratio':41B,91C 'read':28B,83C 'runtim':21B 'self':23B 'self-host':22B 'servic':75C 'size':39B,89C 'system':66B 'unavail':11A,67B,113C 'uncompress':29B,84C 'upload':4A,36B,52B,80C,99C 'user':50B,97C 'vulner':76C 'without':38B,88C 'worker':62B,109C 'zip':3A,30B,79C,102C","nicknames":[],"mitigations":[],"who_affected":"Sites running OpenEMR before 8.5.0 where authenticated users in the billing or Carecoordination roles can upload files. Exposure depends on those roles having upload access; the sources do not say more.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["healthcare","medium","openemr","php","runtime","selfhosted"],"campaign_type":null,"search_a":"'-126423':14A,17A '-2026':13A,16A 'app':10A 'craft':2A 'cve':12A,15A 'exhaust':5A 'make':8A 'memori':6A 'openemr':1A 'unavail':11A 'upload':4A 'zip':3A","search_b":"'8.5.0':27B 'archiv':56B 'authent':44B 'bill':45B 'care':48B 'care-coordin':47B 'check':42B 'compress':55B 'coordin':49B 'entri':31B 'exhaust':58B 'four':35B 'healthcar':18B 'high':54B 'host':24B 'make':64B 'memori':33B,60B 'openemr':19B,25B 'path':37B 'php':20B,59B 'pool':63B 'ratio':41B 'read':28B 'runtim':21B 'self':23B 'self-host':22B 'size':39B 'system':66B 'unavail':67B 'uncompress':29B 'upload':36B,52B 'user':50B 'without':38B 'worker':62B 'zip':30B","search_c":"'8.5.0':70C 'archiv':103C 'authent':93C 'bill':94C 'carecoordin':96C 'check':92C 'compress':101C 'contain':71C 'denial':73C 'entri':85C 'exhaust':105C 'four':78C 'high':100C 'make':111C 'memori':87C,107C 'openemr':68C,112C 'path':81C 'php':106C 'pool':110C 'ratio':91C 'read':83C 'servic':75C 'size':89C 'unavail':113C 'uncompress':84C 'upload':80C,99C 'user':97C 'vulner':76C 'without':88C 'worker':109C 'zip':79C,102C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-28T01:39:15+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126423","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126423","severity":null,"published_at":"2026-11-13T10:17:48+00:00","modified_at":"2026-11-13T10:17:48+00:00","first_seen_at":"2026-11-13T10:47:21+00:00","fetched_at":"2026-11-13T10:47:21+00:00","note":null}],"documents":[{"id":145089,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-pqmf-m4h6-wjh4","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-28T01:39:15+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145090,"url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-denial-of-service-via-zip-upload-decompression","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}