Resource exhaustion in OpenEMR - #VU158840
Published: November 3, 2026
Vulnerability identifier: #VU158840
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to exhaust PHP memory and workers, causing a denial of service in OpenEMR.
The vulnerability exists due to uncontrolled resource consumption in the EDI History, ERA upload, and Carecoordination CCDA import components when extracting ZIP entries without checking their uncompressed sizes or compression ratios. A remote user can upload highly compressed ZIP files containing large entries that are read completely into PHP strings to exceed the PHP memory limit and terminate individual workers; repeated or concurrent uploads can exhaust the available worker pool.
Affected software
OpenEMR
Remediation
Install security update from vendor's website.
OpenEMR - update to 8.5.0