CVE-2026-107885

OpenPrinting CUPS through 2.4.20 contains a resource-exhaustion vulnerability in the submission-timeout handling of cupsdCheckJobs(). The scheduler suppresses timeout processing for all pending jobs whenever any client connection has an in-flight Send-Document operation, without matching that connection to the job being examined. A client allowed to reach the IPP service can hold an incomplete HTTP request containing parsed Send-Document headers before operation authorization, preventing unrelated incomplete jobs from expiring. Where Create-Job submission is allowed, incomplete jobs can accumulate until MaxJobs is exhausted and further legitimate print submissions are rejected. The suppression ends when the held connection closes.

CUPS is the standards-based, open source printing system developed by Apple Inc. for UNIX®-like operating systems. CUPS uses the Internet Printing Protocol (IPP) to support printing to local and network printers.

Security Fix(es):

When a printer is added or modified with a model PPD, the cupsd scheduler (running as root) calls copy_model() in scheduler/ipp.c, which writes the driver-generated PPD to a temporary file. The tempfile path is fully predictable (/number>.ppd, where con->number is the sequential client connection id) and is opened with open(tempfile, O_WRONLY | O_CREAT | O_TRUNC, 0600) — without O_EXCL and without O_NOFOLLOW. TempDir (/var/spool/cups/tmp) is mode 01770 root:lp, i.e. writable by the lp group that print filters run under. An lp-group process can pre-plant a symlink at the predicted path pointing at any root-owned file; root follows the symlink and truncates/overwrites the target, giving an lp → root arbitrary-file-write primitive. The codebase's own cups/tempfile.c opens temporaries safely with O_RDWR|O_CREAT|O_EXCL|O_NOFOLLOW; copy_model() is the inconsistent outlier.(CVE-2025-55480)

An argument injection flaw was found in CUPS. When email notification is configured, the CUPS scheduler accepts printer subscription requests that supply a mailto notify-recipient-uri. The mailto notifier passes the recipient address to the configured sendmail program without ensuring it cannot be interpreted as command-line options. A remote attacker who can reach the CUPS service could supply a crafted recipient value starting with "-" to influence sendmail behavior. Successful exploitation depends on the installed mail transfer agent and CUPS network exposure, and may lead to execution of attacker-controlled commands with the privileges of the CUPS service user.(CVE-2026-105326)

A flaw was found in CUPS. When processing embedded job ticket comments within documents, the service improperly handles specific IPP attributes, causing an unhandled null pointer dereference. An unauthenticated attacker permitted to submit jobs to a shared printer queue can send a crafted Internet Printing Protocol (IPP) request to crash the print daemon, resulting in a temporary Denial of Service (DoS) for all printing services.(CVE-2026-107655)

OpenPrinting CUPS through 2.4.20 contains a resource-exhaustion vulnerability in the submission-timeout handling of cupsdCheckJobs(). The scheduler suppresses timeout processing for all pending jobs whenever any client connection has an in-flight Send-Document operation, without matching that connection to the job being examined. A client allowed to reach the IPP service can hold an incomplete HTTP request containing parsed Send-Document headers before operation authorization, preventing unrelated incomplete jobs from expiring. Where Create-Job submission is allowed, incomplete jobs can accumulate until MaxJobs is exhausted and further legitimate print submissions are rejected. The suppression ends when the held connection closes.(CVE-2026-107885)

OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. When CUPS-Add-Modify-Class replaces an existing class member list, add_class() frees pclass->printers without clearing the pointer. If subsequent validation fails, the class retains the dangling pointer; CUPS-Delete-Class subsequently frees the same allocation in cupsdDeletePrinter(). A client authorized to modify and delete classes can cause scheduler-wide denial of service. The default policy requires @SYSTEM privileges.(CVE-2026-107886)

OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference in cupsdCheckJobs() when a job marked job-held-on-create refers to a temporary printer that has been automatically deleted. Temporary-printer cleanup can remove the destination without canceling its held jobs, and the scheduler dereferences the NULL result of cupsdFindDest() while checking holding_new_jobs. This terminates cupsd and…

CUPS is the standards-based, open source printing system developed by Apple Inc. for UNIX®-like operating systems. CUPS uses the Internet Printing Protocol (IPP) to support printing to local and network printers.

Security Fix(es):

When a printer is added or modified with a model PPD, the cupsd scheduler (running as root) calls copy_model() in scheduler/ipp.c, which writes the driver-generated PPD to a temporary file. The tempfile path is fully predictable (/number>.ppd, where con->number is the sequential client connection id) and is opened with open(tempfile, O_WRONLY | O_CREAT | O_TRUNC, 0600) — without O_EXCL and without O_NOFOLLOW. TempDir (/var/spool/cups/tmp) is mode 01770 root:lp, i.e. writable by the lp group that print filters run under. An lp-group process can pre-plant a symlink at the predicted path pointing at any root-owned file; root follows the symlink and truncates/overwrites the target, giving an lp → root arbitrary-file-write primitive. The codebase's own cups/tempfile.c opens temporaries safely with O_RDWR|O_CREAT|O_EXCL|O_NOFOLLOW; copy_model() is the inconsistent outlier.(CVE-2025-55480)

An argument injection flaw was found in CUPS. When email notification is configured, the CUPS scheduler accepts printer subscription requests that supply a mailto notify-recipient-uri. The mailto notifier passes the recipient address to the configured sendmail program without ensuring it cannot be interpreted as command-line options. A remote attacker who can reach the CUPS service could supply a crafted recipient value starting with "-" to influence sendmail behavior. Successful exploitation depends on the installed mail transfer agent and CUPS network exposure, and may lead to execution of attacker-controlled commands with the privileges of the CUPS service user.(CVE-2026-105326)

A flaw was found in CUPS. When processing embedded job ticket comments within documents, the service improperly handles specific IPP attributes, causing an unhandled null pointer dereference. An unauthenticated attacker permitted to submit jobs to a shared printer queue can send a crafted Internet Printing Protocol (IPP) request to crash the print daemon, resulting in a temporary Denial of Service (DoS) for all printing services.(CVE-2026-107655)

OpenPrinting CUPS through 2.4.20 contains a resource-exhaustion vulnerability in the submission-timeout handling of cupsdCheckJobs(). The scheduler suppresses timeout processing for all pending jobs whenever any client connection has an in-flight Send-Document operation, without matching that connection to the job being examined. A client allowed to reach the IPP service can hold an incomplete HTTP request containing parsed Send-Document headers before operation authorization, preventing unrelated incomplete jobs from expiring. Where Create-Job submission is allowed, incomplete jobs can accumulate until MaxJobs is exhausted and further legitimate print submissions are rejected. The suppression ends when the held connection closes.(CVE-2026-107885)

OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. When CUPS-Add-Modify-Class replaces an existing class member list, add_class() frees pclass->printers without clearing the pointer. If subsequent validation fails, the class retains the dangling pointer; CUPS-Delete-Class subsequently frees the same allocation in cupsdDeletePrinter(). A client authorized to modify and delete classes can cause scheduler-wide denial of service. The default policy requires @SYSTEM privileges.(CVE-2026-107886)

OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference in cupsdCheckJobs() when a job marked job-held-on-create refers to a temporary printer that has been automatically deleted. Temporary-printer cleanup can remove the destination without canceling its held jobs, and the scheduler dereferences the NULL result of cupsdFindDest() while checking holding_new_jobs. This terminates cupsd and…

CUPS is the standards-based, open source printing system developed by Apple Inc. for UNIX®-like operating systems. CUPS uses the Internet Printing Protocol (IPP) to support printing to local and network printers.

Security Fix(es):

When a printer is added or modified with a model PPD, the cupsd scheduler (running as root) calls copy_model() in scheduler/ipp.c, which writes the driver-generated PPD to a temporary file. The tempfile path is fully predictable (/number>.ppd, where con->number is the sequential client connection id) and is opened with open(tempfile, O_WRONLY | O_CREAT | O_TRUNC, 0600) — without O_EXCL and without O_NOFOLLOW. TempDir (/var/spool/cups/tmp) is mode 01770 root:lp, i.e. writable by the lp group that print filters run under. An lp-group process can pre-plant a symlink at the predicted path pointing at any root-owned file; root follows the symlink and truncates/overwrites the target, giving an lp → root arbitrary-file-write primitive. The codebase's own cups/tempfile.c opens temporaries safely with O_RDWR|O_CREAT|O_EXCL|O_NOFOLLOW; copy_model() is the inconsistent outlier.(CVE-2025-55480)

An argument injection flaw was found in CUPS. When email notification is configured, the CUPS scheduler accepts printer subscription requests that supply a mailto notify-recipient-uri. The mailto notifier passes the recipient address to the configured sendmail program without ensuring it cannot be interpreted as command-line options. A remote attacker who can reach the CUPS service could supply a crafted recipient value starting with "-" to influence sendmail behavior. Successful exploitation depends on the installed mail transfer agent and CUPS network exposure, and may lead to execution of attacker-controlled commands with the privileges of the CUPS service user.(CVE-2026-105326)

A flaw was found in CUPS. When processing embedded job ticket comments within documents, the service improperly handles specific IPP attributes, causing an unhandled null pointer dereference. An unauthenticated attacker permitted to submit jobs to a shared printer queue can send a crafted Internet Printing Protocol (IPP) request to crash the print daemon, resulting in a temporary Denial of Service (DoS) for all printing services.(CVE-2026-107655)

OpenPrinting CUPS through 2.4.20 contains a resource-exhaustion vulnerability in the submission-timeout handling of cupsdCheckJobs(). The scheduler suppresses timeout processing for all pending jobs whenever any client connection has an in-flight Send-Document operation, without matching that connection to the job being examined. A client allowed to reach the IPP service can hold an incomplete HTTP request containing parsed Send-Document headers before operation authorization, preventing unrelated incomplete jobs from expiring. Where Create-Job submission is allowed, incomplete jobs can accumulate until MaxJobs is exhausted and further legitimate print submissions are rejected. The suppression ends when the held connection closes.(CVE-2026-107885)

OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. When CUPS-Add-Modify-Class replaces an existing class member list, add_class() frees pclass->printers without clearing the pointer. If subsequent validation fails, the class retains the dangling pointer; CUPS-Delete-Class subsequently frees the same allocation in cupsdDeletePrinter(). A client authorized to modify and delete classes can cause scheduler-wide denial of service. The default policy requires @SYSTEM privileges.(CVE-2026-107886)

OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference in cupsdCheckJobs() when a job marked job-held-on-create refers to a temporary printer that has been automatically deleted. Temporary-printer cleanup can remove the destination without canceling its held jobs, and the scheduler dereferences the NULL result of cupsdFindDest() while checking holding_new_jobs. This terminates cupsd and…

CUPS is the standards-based, open source printing system developed by Apple Inc. for UNIX®-like operating systems. CUPS uses the Internet Printing Protocol (IPP) to support printing to local and network printers.

Security Fix(es):

When a printer is added or modified with a model PPD, the cupsd scheduler (running as root) calls copy_model() in scheduler/ipp.c, which writes the driver-generated PPD to a temporary file. The tempfile path is fully predictable (/number>.ppd, where con->number is the sequential client connection id) and is opened with open(tempfile, O_WRONLY | O_CREAT | O_TRUNC, 0600) — without O_EXCL and without O_NOFOLLOW. TempDir (/var/spool/cups/tmp) is mode 01770 root:lp, i.e. writable by the lp group that print filters run under. An lp-group process can pre-plant a symlink at the predicted path pointing at any root-owned file; root follows the symlink and truncates/overwrites the target, giving an lp → root arbitrary-file-write primitive. The codebase's own cups/tempfile.c opens temporaries safely with O_RDWR|O_CREAT|O_EXCL|O_NOFOLLOW; copy_model() is the inconsistent outlier.(CVE-2025-55480)

An argument injection flaw was found in CUPS. When email notification is configured, the CUPS scheduler accepts printer subscription requests that supply a mailto notify-recipient-uri. The mailto notifier passes the recipient address to the configured sendmail program without ensuring it cannot be interpreted as command-line options. A remote attacker who can reach the CUPS service could supply a crafted recipient value starting with "-" to influence sendmail behavior. Successful exploitation depends on the installed mail transfer agent and CUPS network exposure, and may lead to execution of attacker-controlled commands with the privileges of the CUPS service user.(CVE-2026-105326)

A flaw was found in CUPS. When processing embedded job ticket comments within documents, the service improperly handles specific IPP attributes, causing an unhandled null pointer dereference. An unauthenticated attacker permitted to submit jobs to a shared printer queue can send a crafted Internet Printing Protocol (IPP) request to crash the print daemon, resulting in a temporary Denial of Service (DoS) for all printing services.(CVE-2026-107655)

OpenPrinting CUPS through 2.4.20 contains a resource-exhaustion vulnerability in the submission-timeout handling of cupsdCheckJobs(). The scheduler suppresses timeout processing for all pending jobs whenever any client connection has an in-flight Send-Document operation, without matching that connection to the job being examined. A client allowed to reach the IPP service can hold an incomplete HTTP request containing parsed Send-Document headers before operation authorization, preventing unrelated incomplete jobs from expiring. Where Create-Job submission is allowed, incomplete jobs can accumulate until MaxJobs is exhausted and further legitimate print submissions are rejected. The suppression ends when the held connection closes.(CVE-2026-107885)

OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. When CUPS-Add-Modify-Class replaces an existing class member list, add_class() frees pclass->printers without clearing the pointer. If subsequent validation fails, the class retains the dangling pointer; CUPS-Delete-Class subsequently frees the same allocation in cupsdDeletePrinter(). A client authorized to modify and delete classes can cause scheduler-wide denial of service. The default policy requires @SYSTEM privileges.(CVE-2026-107886)

OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference in cupsdCheckJobs() when a job marked job-held-on-create refers to a temporary printer that has been automatically deleted. Temporary-printer cleanup can remove the destination without canceling its held jobs, and the scheduler dereferences the NULL result of cupsdFindDest() while checking holding_new_jobs. This terminates cupsd and…

OpenPrinting CUPS through 2.4.20 contains a resource-exhaustion vulnerability in the submission-timeout handling of cupsdCheckJobs(). The scheduler suppresses timeout processing for all pending jobs whenever any client connection has an in-flight Send-Document operation, without matching that connection to the job being examined. A client allowed to reach the IPP service can hold an incomplete HTTP request containing parsed Send-Document headers before operation authorization, preventing unrelated incomplete jobs from expiring. Where Create-Job submission is allowed, incomplete jobs can accumulate until MaxJobs is exhausted and further legitimate print submissions are rejected. The suppression ends when the held connection closes.

OpenPrinting CUPS through 2.4.20 contains a resource-exhaustion vulnerability in the submission-timeout handling of cupsdCheckJobs(). The scheduler suppresses timeout processing for all pending jobs whenever any client connection has an in-flight Send-Document operation, without matching that connection to the job being examined. A client allowed to reach the IPP service can hold an incomplete HTTP request containing parsed Send-Document headers before operation authorization, preventing unrelated incomplete jobs from expiring. Where Create-Job submission is allowed, incomplete jobs can accumulate until MaxJobs is exhausted and further legitimate print submissions are rejected. The suppression ends when the held connection closes.

• CVE-2026-107885: store a deadline in pending_timeout and only defer the submission timeout in cupsdCheckJobs() while that deadline has not passed

• SECURITY UPDATE: NULL pointer dereference on held jobs
  • debian/patches/CVE-2026-107888.patch: abort a held job whose destination printer or class has gone away instead of dereferencing a NULL printer in scheduler/job.c cupsdCheckJobs(); backport of upstream commit c5fc041ca0a211f8e69854907be7b55f56955659
  • CVE-2026-107888
• SECURITY UPDATE: double free in printer-class management
  • debian/patches/CVE-2026-107886.patch: clear the class printers pointer after freeing it in scheduler/ipp.c add_class(); backport of upstream commit 13bc9d4f8d695403d54469cc3c8b675e34a7037f
  • CVE-2026-107886
• SECURITY UPDATE: resource exhaustion via held Send-Document requests
  • debian/patches/CVE-2026-107885.patch: bound the time an in-flight Send-Document may delay the submission timeout to MultipleOperationTimeout in scheduler/ipp.c, scheduler/job.c and scheduler/job.h; backport of upstream commit 3bb26257e343d2da2bee12bcc1e7a9b283fe4bec
  • CVE-2026-107885

• CVE-2026-107885: Don't allow clients to hold a job open longer than the multiple-operation-time-out value

• CVE-2026-107885: prevent clients from holding multiple open print jobs beyond the configured timeout
• CVE-2026-107886: prevent a scheduler crash when modifying a class
• CVE-2026-107888: prevent a scheduler crash when a held job destination disappears
• CVE-2026-107890: filter group separators from job creation requests

• CVE-2026-107885: Don't allow clients to hold a job open longer than the multiple-operation-time-out value

• CVE-2026-107885: Don't allow clients to hold a job open longer than the multiple-operation-time-out value

• CVE-2026-107885: fix denial of service by not letting an in-flight Send-Document suppress submission timeouts of unrelated held jobs beyond MultipleOperationTimeout
• CVE-2026-107890: fix cupsd NULL pointer dereference caused by repeated IPP group tags in job creation requests

• CVE-2026-107885: fix denial of service by not letting an in-flight Send-Document suppress submission timeouts of unrelated held jobs beyond MultipleOperationTimeout
• CVE-2026-107890: fix cupsd NULL pointer dereference caused by repeated IPP group tags in job creation requests

• SECURITY UPDATE: fix denial of service in cupsd where a client holding an in-flight Send-Document request stopped unrelated incomplete jobs from timing out, allowing them to accumulate until MaxJobs.
  • debian/patches/CVE-2026-107885.patch: give created jobs an absolute pending timeout of now + MultipleOperationTimeout and stop deferring the timeout for in-flight Send-Document requests once it passes in create_job() and cupsdCheckJobs().
  • CVE-2026-107885.
• SECURITY UPDATE: fix NULL pointer dereference in cupsd caused by repeated IPP group tags in job-creation requests.
  • debian/patches/CVE-2026-107890.patch: remove unnamed group separator attributes from new job requests in add_job() and add_job_subscriptions() in scheduler/ipp.c.
  • CVE-2026-107890.

• CVE-2026-107890: scheduler: NULL pointer dereference on repeated IPP group tags
• CVE-2026-107885: scheduler: incomplete jobs could be held open indefinitely, exhausting MaxJobs

• CVE-2026-107890: scheduler: NULL pointer dereference on repeated IPP group tags
• CVE-2026-107885: scheduler: incomplete jobs could be held open indefinitely, exhausting MaxJobs

• CVE-2026-107890: scheduler: NULL pointer dereference on repeated IPP group tags
• CVE-2026-107885: scheduler: incomplete jobs could be held open indefinitely, exhausting MaxJobs

• SECURITY UPDATE: pending-job submission timeout suppressed by any in-flight Send-Document request
  • debian/patches/CVE-2026-107885.patch: expire pending jobs once multiple-operation-time-out has elapsed in cupsdCheckJobs() in scheduler/job.c, scheduler/job.h and scheduler/ipp.c
  • CVE-2026-107885

• SECURITY UPDATE: job submission timeouts suppressed by an in-flight Send-Document request
  • debian/patches/CVE-2026-107885.patch: record the submission deadline in job->pending_timeout in create_job() and stop deferring the timeout in cupsdCheckJobs() once that deadline has passed
  • CVE-2026-107885