CVE-2026-126423: OpenEMR before 8.5.0 Denial of Service via ZIP Upload Decompression
OpenEMR before 8.5.0 contains a denial of service vulnerability in four ZIP upload paths that read uncompressed entries into memory without size or ratio checks. Authenticated billing or Carecoordination users can upload highly compressed ZIP archives to exhaust PHP memory and worker pools, making OpenEMR unavailable.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with billing or Carecoordination access can exploit it. The attack can be performed remotely and does not require user interaction.
Are default deployments affected?
The provided information identifies four ZIP upload paths that lack uncompressed-size and compression-ratio checks, but it does not state whether those paths are enabled or reachable in a default deployment.
What is the practical impact of exploitation?
A user can upload a highly compressed ZIP archive that expands in memory, exhausting PHP memory and worker pools. This can make the OpenEMR application unavailable.
How can we determine whether we are affected?
Deployments running OpenEMR before version 8.5.0 are affected according to the provided information. Review whether billing or Carecoordination users can access the ZIP upload functionality.