CVE-2009-0164

The web interface for CUPS before 1.3.10 does not validate the HTTP Host header in a client...

6.4 MediumFix available

The web interface for CUPS before 1.3.10 does not validate the HTTP Host header in a client request, which makes it easier for remote attackers to conduct DNS rebinding attacks.

Exploit likelihood

2.91%Down 0.9 points since Feb 4, 2022

What each source reports

NVD Score used 6.4

The web interface for CUPS before 1.3.10 does not validate the HTTP Host header in a client request, which makes it easier for remote attackers to conduct DNS rebinding attacks.

Record: CVE-2009-0164
CVSS 2.0: 6.4 MediumAV:N/AC:L/Au:N/C:N/I:P/A:P
Weakness: CWE-20
Updated: 2026-11-02

CVE List No score

The web interface for CUPS before 1.3.10 does not validate the HTTP Host header in a client request, which makes it easier for remote attackers to conduct DNS rebinding attacks.

Record: CVE-2009-0164
Updated: 2026-11-02

EUVDEUVD-2009-0173 No score

The web interface for CUPS before 1.3.10 does not validate the HTTP Host header in a client request, which makes it easier for remote attackers to conduct DNS rebinding attacks.

Record: EUVD-2009-0173
Updated: 2026-11-03

GitHub AdvisoriesGHSA-x338-9gp2-578v No score

The web interface for CUPS before 1.3.10 does not validate the HTTP Host header in a client...

The web interface for CUPS before 1.3.10 does not validate the HTTP Host header in a client request, which makes it easier for remote attackers to conduct DNS rebinding attacks.

Record: GHSA-x338-9gp2-578v
Weakness: CWE-20
Updated: 2026-11-02

OSV No score

The web interface for CUPS before 1.3.10 does not validate the HTTP Host header in a client request, which makes it easier for remote attackers to conduct DNS rebinding attacks.

Record: CVE-2009-0164
Updated: 2026-11-02

OSVDEBIAN-CVE-2009-0164 No score

The web interface for CUPS before 1.3.10 does not validate the HTTP Host header in a client request, which makes it easier for remote attackers to conduct DNS rebinding attacks.

Record: DEBIAN-CVE-2009-0164
Updated: 2026-11-02

Affected products

apple cups

Affected packages

Affected packages
Package	Affected	Fixed
`cups` Debian:12	before 1.3.10-1	1.3.10-1
`cups` Debian:13	before 1.3.10-1	1.3.10-1
`cups` Debian:14	before 1.3.10-1	1.3.10-1

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2009-0164 is a medium vulnerability (CVSS 6.4) in Apple Cups, published April 24, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.91%, the 87th percentile. Fixed in cups 1.3.10-1.

References

Show 10 moreShow less