CVE-2026-126421: OpenEMR before 8.5.0 Denial of Service via labs_ajax.php Label Count
Published Nov 13, 2026
·Updated
OpenEMR before 8.5.0 contains an uncontrolled resource consumption vulnerability that allows authenticated users with patients/med access to exhaust PHP workers via an unbounded count parameter. Attackers can send printlabels requests to labsajax.php with huge counts, forcing mPDF page and barcode generation that makes OpenEMR unavailable.
Affected Software
1 affected component
OpenEMR OpenEMR<8.5.0
Event History
Nov 13, 2026
CVE Published
via MITRE·09:35 AM
Data Sourced
via MITRE·09:35 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·10:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which users can exploit this issue?
An attacker must be authenticated and have access to patients and medications. The issue can be triggered through print_labels requests to labs_ajax.php.
2
What is required to cause service disruption?
The attacker can submit a very large count parameter in a print_labels request. This causes mPDF page and barcode generation to consume PHP workers, potentially making OpenEMR unavailable.
3
Which versions are affected?
OpenEMR versions before 8.5.0 are affected.