{"id":"CVE-2026-41079","aliases":["AZL-83627","CLSA-2026-1777545654","CLSA-2026-1778234216","DEBIAN-CVE-2026-41079","EUVD-2026-25574","GHSA-6wpw-g8g6-wvrv","OESA-2026-2197","ROOT-OS-DEBIAN-12-CVE-2026-41079","ROOT-OS-DEBIAN-13-CVE-2026-41079","SUSE-SU-2026:21787-1","SUSE-SU-2026:21836-1","SUSE-SU-2026:21850-1","SUSE-SU-2026:21871-1","SUSE-SU-2026:4447-1","SUSE-SU-2026:5078-1","UBUNTU-CVE-2026-41079","USN-8405-1","openSUSE-SU-2026:10820-1","openSUSE-SU-2026:20812-1"],"status":"published","title":"OpenPrinting CUPS: Heap out-of-bounds read in SNMP supply-level polling leaks stack memory to authenticated users","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.17, a network-adjacent attacker can send a crafted SNMP response to the CUPS SNMP backend that causes an out-of-bounds read of up to 176 bytes past a stack buffer. The leaked memory is converted from UTF-16 to UTF-8 and stored as printer supply description strings, which are subsequently visible to authenticated users via IPP Get-Printer-Attributes responses and the CUPS web interface. This vulnerability is fixed in 2.4.17.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00409,"percentile":0.35626,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125","CWE-200"],"published":"2026-04-24T16:54:38Z","modified":"2026-11-03T22:56:56Z","fixes":[{"ecosystem":"Azure Linux:3","package":"cups","fixed_in":["2.4.18-1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"cups","fixed_in":["1:2.3.3op2-33.el9_6.1.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"cups-client","fixed_in":["1:2.3.3op2-33.el9_6.1.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"cups-devel","fixed_in":["1:2.3.3op2-33.el9_6.1.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"cups-filesystem","fixed_in":["1:2.3.3op2-33.el9_6.1.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"cups-ipptool","fixed_in":["1:2.3.3op2-33.el9_6.1.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"cups-libs","fixed_in":["1:2.3.3op2-33.el9_6.1.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"cups-lpd","fixed_in":["1:2.3.3op2-33.el9_6.1.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"cups-printerapp","fixed_in":["1:2.3.3op2-33.el9_6.1.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"cups","fixed_in":["1:2.3.3op2-16.el9_2.1.tuxcare.els11"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"cups-client","fixed_in":["1:2.3.3op2-16.el9_2.1.tuxcare.els11"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"cups-devel","fixed_in":["1:2.3.3op2-16.el9_2.1.tuxcare.els11"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"cups-filesystem","fixed_in":["1:2.3.3op2-16.el9_2.1.tuxcare.els11"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"cups-ipptool","fixed_in":["1:2.3.3op2-16.el9_2.1.tuxcare.els11"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"cups-libs","fixed_in":["1:2.3.3op2-16.el9_2.1.tuxcare.els11"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"cups-lpd","fixed_in":["1:2.3.3op2-16.el9_2.1.tuxcare.els11"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"cups-printerapp","fixed_in":["1:2.3.3op2-16.el9_2.1.tuxcare.els11"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"cups","fixed_in":["2.4.17-1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"cups","fixed_in":["2.4.7-15.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"cups","fixed_in":["2.4.7-14.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"cups","fixed_in":["2.4.7-15.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"cups","fixed_in":["2.2.13-25.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"cups","fixed_in":["2.4.0-20.oe2203sp4"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"cups","fixed_in":["2.4.2-3+deb12u9.root.io.4","2.4.2-3+deb12u9.aikido.5"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-cups","fixed_in":["2.4.2-3+deb12u9.root.io.4","2.4.2-3+deb12u9.aikido.5"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"cups","fixed_in":["2.4.10-3+deb13u2.aikido.5","2.4.10-3+deb13u2.aikido.6"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"rootio-cups","fixed_in":["2.4.10-3+deb13u2.aikido.5","2.4.10-3+deb13u2.aikido.6"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"cups","fixed_in":["1.7.5-20.73.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"cups","fixed_in":["2.4.1op1-1ubuntu4.20"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"cups","fixed_in":["2.4.7-1.2ubuntu7.13"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"cups","fixed_in":["2.4.12-0ubuntu3.9"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"cups","fixed_in":["2.4.16-1ubuntu1.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"cups","fixed_in":["2.4.19-2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.18-1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.3op2-33.el9_6.1.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"cups-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.3op2-33.el9_6.1.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"cups-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.3op2-33.el9_6.1.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"cups-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.3op2-33.el9_6.1.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"cups-ipptool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.3op2-33.el9_6.1.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"cups-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.3op2-33.el9_6.1.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"cups-lpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.3op2-33.el9_6.1.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"cups-printerapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.3op2-33.el9_6.1.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.3op2-16.el9_2.1.tuxcare.els11"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"cups-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.3op2-16.el9_2.1.tuxcare.els11"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"cups-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.3op2-16.el9_2.1.tuxcare.els11"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"cups-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.3op2-16.el9_2.1.tuxcare.els11"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"cups-ipptool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.3op2-16.el9_2.1.tuxcare.els11"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"cups-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.3op2-16.el9_2.1.tuxcare.els11"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"cups-lpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.3op2-16.el9_2.1.tuxcare.els11"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"cups-printerapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.3.3op2-16.el9_2.1.tuxcare.els11"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.10-1","2.4.10-2","2.4.10-3","2.4.10-4","2.4.14-1","2.4.15-1","2.4.16-1","2.4.17-1","2.4.18-1","2.4.2-3","2.4.2-3+deb12u1","2.4.2-3+deb12u2","2.4.2-3+deb12u3","2.4.2-3+deb12u4","2.4.2-3+deb12u5","2.4.2-3+deb12u6","2.4.2-3+deb12u7","2.4.2-3+deb12u8","2.4.2-3+deb12u9","2.4.2-4","2.4.2-5","2.4.2-6","2.4.20-1","2.4.7-1","2.4.7-1.1","2.4.7-1.2","2.4.7-2","2.4.7-3"]},{"source":"osv","ecosystem":"Debian:13","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.10-3","2.4.10-3+deb13u1","2.4.10-3+deb13u2","2.4.10-4","2.4.14-1","2.4.15-1","2.4.16-1","2.4.17-1","2.4.18-1","2.4.20-1"]},{"source":"osv","ecosystem":"Debian:14","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.17-1"}]}],"versions":["2.4.10-3","2.4.10-4","2.4.14-1","2.4.15-1","2.4.16-1"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.7-15.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.7-14.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.7-15.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.13-25.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-20.oe2203sp4"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.2-3+deb12u9.root.io.4"},{"fixed":"2.4.2-3+deb12u9.aikido.5"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.2-3+deb12u9.root.io.4"},{"fixed":"2.4.2-3+deb12u9.aikido.5"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.10-3+deb13u2.aikido.5"},{"fixed":"2.4.10-3+deb13u2.aikido.6"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"rootio-cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.10-3+deb13u2.aikido.5"},{"fixed":"2.4.10-3+deb13u2.aikido.6"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.5-20.73.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.7-150000.3.101.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.7-150000.3.101.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.7-150000.3.101.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.7-150000.3.101.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.7-150000.3.101.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.7-150000.3.101.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.7-150000.3.101.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.7-150000.3.101.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.7-150000.3.101.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.7-150000.3.101.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.7-150000.3.101.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.7-150000.3.101.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.7-150000.3.101.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.7-150000.3.101.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.7-150000.3.101.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.7-150000.3.101.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.0-4ubuntu3","2.1.0-5","2.1.0-6","2.1.0-6ubuntu1","2.1.0-7","2.1.2-1","2.1.2-2","2.1.3-1","2.1.3-1build1","2.1.3-3","2.1.3-4","2.1.3-4ubuntu0.2","2.1.3-4ubuntu0.3","2.1.3-4ubuntu0.4","2.1.3-4ubuntu0.5","2.1.3-4ubuntu0.6","2.1.3-4ubuntu0.7","2.1.3-4ubuntu0.8","2.1.3-4ubuntu0.9","2.1.3-4ubuntu0.10","2.1.3-4ubuntu0.11","2.1.3-4ubuntu0.11+esm1","2.1.3-4ubuntu0.11+esm2","2.1.3-4ubuntu0.11+esm3","2.1.3-4ubuntu0.11+esm4","2.1.3-4ubuntu0.11+esm5","2.1.3-4ubuntu0.11+esm6","2.1.3-4ubuntu0.11+esm7","2.1.3-4ubuntu0.11+esm8","2.1.3-4ubuntu0.11+esm9","2.1.3-4ubuntu0.11+esm11","2.1.3-4ubuntu0.11+esm12","2.1.3-4ubuntu0.11+esm13"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.4-7ubuntu2","2.2.5-2","2.2.6-2","2.2.6-3","2.2.6-4","2.2.6-5","2.2.7-1ubuntu1","2.2.7-1ubuntu2","2.2.7-1ubuntu2.1","2.2.7-1ubuntu2.2","2.2.7-1ubuntu2.3","2.2.7-1ubuntu2.4","2.2.7-1ubuntu2.5","2.2.7-1ubuntu2.6","2.2.7-1ubuntu2.7","2.2.7-1ubuntu2.8","2.2.7-1ubuntu2.9","2.2.7-1ubuntu2.10","2.2.7-1ubuntu2.10+esm1","2.2.7-1ubuntu2.10+esm2","2.2.7-1ubuntu2.10+esm3","2.2.7-1ubuntu2.10+esm4","2.2.7-1ubuntu2.10+esm5","2.2.7-1ubuntu2.10+esm6","2.2.7-1ubuntu2.10+esm7","2.2.7-1ubuntu2.10+esm9","2.2.7-1ubuntu2.10+esm10"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.12-2ubuntu1","2.3.0-6","2.3.0-7","2.3.0-7ubuntu1","2.3.1-1ubuntu1","2.3.1-2","2.3.1-4","2.3.1-7","2.3.1-9ubuntu1","2.3.1-9ubuntu1.1","2.3.1-9ubuntu1.2","2.3.1-9ubuntu1.3","2.3.1-9ubuntu1.4","2.3.1-9ubuntu1.5","2.3.1-9ubuntu1.6","2.3.1-9ubuntu1.7","2.3.1-9ubuntu1.8","2.3.1-9ubuntu1.9","2.3.1-9ubuntu1.9+esm1","2.3.1-9ubuntu1.9+esm3","2.3.1-9ubuntu1.9+esm4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1op1-1ubuntu4.20"}]}],"versions":["2.3.3op2-7ubuntu2","2.4.1op1-1ubuntu1","2.4.1op1-1ubuntu2","2.4.1op1-1ubuntu3","2.4.1op1-1ubuntu4","2.4.1op1-1ubuntu4.1","2.4.1op1-1ubuntu4.2","2.4.1op1-1ubuntu4.4","2.4.1op1-1ubuntu4.6","2.4.1op1-1ubuntu4.7","2.4.1op1-1ubuntu4.8","2.4.1op1-1ubuntu4.9","2.4.1op1-1ubuntu4.10","2.4.1op1-1ubuntu4.11","2.4.1op1-1ubuntu4.12","2.4.1op1-1ubuntu4.15","2.4.1op1-1ubuntu4.16"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.7-1.2ubuntu7.13"}]}],"versions":["2.4.6-0ubuntu3","2.4.7-1.2ubuntu2","2.4.7-1.2ubuntu3","2.4.7-1.2ubuntu7","2.4.7-1.2ubuntu7.1","2.4.7-1.2ubuntu7.2","2.4.7-1.2ubuntu7.3","2.4.7-1.2ubuntu7.4","2.4.7-1.2ubuntu7.7","2.4.7-1.2ubuntu7.9"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.12-0ubuntu3.9"}]}],"versions":["2.4.12-0ubuntu1","2.4.12-0ubuntu2","2.4.12-0ubuntu3","2.4.12-0ubuntu3.3","2.4.12-0ubuntu3.5"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.16-1ubuntu1.2"}]}],"versions":["2.4.12-0ubuntu3","2.4.12-0ubuntu5","2.4.16-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1op1-1ubuntu4.20"}]}],"versions":["2.3.3op2-7ubuntu2","2.4.1op1-1ubuntu1","2.4.1op1-1ubuntu2","2.4.1op1-1ubuntu3","2.4.1op1-1ubuntu4","2.4.1op1-1ubuntu4.1","2.4.1op1-1ubuntu4.2","2.4.1op1-1ubuntu4.4","2.4.1op1-1ubuntu4.6","2.4.1op1-1ubuntu4.7","2.4.1op1-1ubuntu4.8","2.4.1op1-1ubuntu4.9","2.4.1op1-1ubuntu4.10","2.4.1op1-1ubuntu4.11","2.4.1op1-1ubuntu4.12","2.4.1op1-1ubuntu4.15","2.4.1op1-1ubuntu4.16"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.7-1.2ubuntu7.13"}]}],"versions":["2.4.6-0ubuntu3","2.4.7-1.2ubuntu2","2.4.7-1.2ubuntu3","2.4.7-1.2ubuntu7","2.4.7-1.2ubuntu7.1","2.4.7-1.2ubuntu7.2","2.4.7-1.2ubuntu7.3","2.4.7-1.2ubuntu7.4","2.4.7-1.2ubuntu7.7","2.4.7-1.2ubuntu7.9"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.12-0ubuntu3.9"}]}],"versions":["2.4.12-0ubuntu1","2.4.12-0ubuntu2","2.4.12-0ubuntu3","2.4.12-0ubuntu3.3","2.4.12-0ubuntu3.5"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.16-1ubuntu1.2"}]}],"versions":["2.4.12-0ubuntu3","2.4.12-0ubuntu5","2.4.16-1ubuntu1"],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.19-2.1"}]}]}],"products":[{"vendor":"openprinting","product":"cups"}],"references":[{"url":"https://github.com/OpenPrinting/cups/security/advisories/GHSA-6wpw-g8g6-wvrv","tags":["x_refsource_CONFIRM","exploit","Exploit","Mitigation","Patch","Vendor Advisory","advisory","report"]},{"url":"https://github.com/OpenPrinting/cups/commit/b7c2525a885f528d243c3a92197ca99609b3f080","tags":["x_refsource_MISC","Patch","fix"]},{"url":"https://github.com/OpenPrinting/cups/commit/d7fe0f521ff3b24676511e747b058362b9a20737","tags":["x_refsource_MISC","Patch","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41079","tags":["web","advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1777545654.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1778234216.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41079.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-41079","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2197","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621787-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1261568","tags":["report"]},{"url":"https://bugzilla.suse.com/1261569","tags":["report"]},{"url":"https://bugzilla.suse.com/1261570","tags":["report"]},{"url":"https://bugzilla.suse.com/1261571","tags":["report"]},{"url":"https://bugzilla.suse.com/1261572","tags":["report"]},{"url":"https://bugzilla.suse.com/1261742","tags":["report"]},{"url":"https://bugzilla.suse.com/1261743","tags":["report"]},{"url":"https://bugzilla.suse.com/1263116","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27447","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34978","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34979","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34980","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34990","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39314","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39316","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41079","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621836-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621850-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621871-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264447-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20265078-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1284274","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-105326","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-41079","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-41079","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8405-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-27447","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-34978","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-34979","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-34980","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-34990","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-39314","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-39316","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-41079","title":"OpenPrinting CUPS: Heap out-of-bounds read in SNMP supply-level polling leaks stack memory to authenticated users","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.17, a network-adjacent attacker can send a crafted SNMP response to the CUPS SNMP backend that causes an out-of-bounds read of up to 176 bytes past a stack buffer. The leaked memory is converted from UTF-16 to UTF-8 and stored as printer supply description strings, which are subsequently visible to authenticated users via IPP Get-Printer-Attributes responses and the CUPS web interface. This vulnerability is fixed in 2.4.17.","status":"published","published":"2026-04-24T16:54:38.742Z","modified":"2026-04-25T01:47:44.54Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-125","CWE-200"],"updated_at":"2026-11-02T13:40:57.334596Z"}],"euvd":[{"id":"EUVD-2026-25574","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.17, a network-adjacent attacker can send a crafted SNMP response to the CUPS SNMP backend that causes an out-of-bounds read of up to 176 bytes past a stack buffer. The leaked memory is converted from UTF-16 to UTF-8 and stored as printer supply description strings, which are subsequently visible to authenticated users via IPP Get-Printer-Attributes responses and the CUPS web interface. This vulnerability is fixed in 2.4.17.","status":"published","published":"2026-04-24T16:54:38Z","modified":"2026-04-25T01:47:44Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T19:24:18.224827Z"}],"nvd":[{"id":"CVE-2026-41079","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.17, a network-adjacent attacker can send a crafted SNMP response to the CUPS SNMP backend that causes an out-of-bounds read of up to 176 bytes past a stack buffer. The leaked memory is converted from UTF-16 to UTF-8 and stored as printer supply description strings, which are subsequently visible to authenticated users via IPP Get-Printer-Attributes responses and the CUPS web interface. This vulnerability is fixed in 2.4.17.","status":"published","published":"2026-04-24T17:16:21.34Z","modified":"2026-10-26T21:10:00.17Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium","assessor":"primary"}],"cwes":["CWE-125","CWE-200"],"updated_at":"2026-11-02T14:12:15.867234Z"}],"osv":[{"id":"CVE-2026-41079","title":"OpenPrinting CUPS: Heap out-of-bounds read in SNMP supply-level polling leaks stack memory to authenticated users","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.17, a network-adjacent attacker can send a crafted SNMP response to the CUPS SNMP backend that causes an out-of-bounds read of up to 176 bytes past a stack buffer. The leaked memory is converted from UTF-16 to UTF-8 and stored as printer supply description strings, which are subsequently visible to authenticated users via IPP Get-Printer-Attributes responses and the CUPS web interface. This vulnerability is fixed in 2.4.17.","status":"published","published":"2026-04-24T16:54:38.742Z","modified":"2026-11-03T22:56:56.476621141Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-125","CWE-200"],"updated_at":"2026-11-03T23:33:41.569033Z"},{"id":"DEBIAN-CVE-2026-41079","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.17, a network-adjacent attacker can send a crafted SNMP response to the CUPS SNMP backend that causes an out-of-bounds read of up to 176 bytes past a stack buffer. The leaked memory is converted from UTF-16 to UTF-8 and stored as printer supply description strings, which are subsequently visible to authenticated users via IPP Get-Printer-Attributes responses and the CUPS web interface. This vulnerability is fixed in 2.4.17.","status":"published","published":"2026-04-24T17:16:21.34Z","modified":"2026-10-27T10:01:16.752507107Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:54.892385Z"},{"id":"OESA-2026-2197","title":"cups security update","description":"CUPS is the standards-based, open source printing system developed by Apple Inc. for UNIX®-like operating systems. CUPS uses the Internet Printing Protocol (IPP) to support printing to local and network printers.\r\n\r\nSecurity Fix(es):\n\nOpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.17, a network-adjacent attacker can send a crafted SNMP response to the CUPS SNMP backend that causes an out-of-bounds read of up to 176 bytes past a stack buffer. The leaked memory is converted from UTF-16 to UTF-8 and stored as printer supply description strings, which are subsequently visible to authenticated users via IPP Get-Printer-Attributes responses and the CUPS web interface. This vulnerability is fixed in 2.4.17.(CVE-2026-41079)","status":"published","published":"2026-05-03T11:11:10Z","modified":"2026-08-18T01:19:51.459603636Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-41079","title":"CVE-2026-41079 in cups - Patched by Root","description":"Root has patched CVE-2026-41079 in the cups package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-08-25T08:44:39Z","modified":"2026-08-26T01:10:31.947581932Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:32.037361Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2026-41079","title":"CVE-2026-41079 in cups - Patched by Root","description":"Root has patched CVE-2026-41079 in the cups package for Root:Debian:13. Multiple fixed versions available.","status":"published","published":"2026-08-24T06:48:45Z","modified":"2026-08-24T08:15:07.529103786Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:33.681527Z"},{"id":"UBUNTU-CVE-2026-41079","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.17, a network-adjacent attacker can send a crafted SNMP response to the CUPS SNMP backend that causes an out-of-bounds read of up to 176 bytes past a stack buffer. The leaked memory is converted from UTF-16 to UTF-8 and stored as printer supply description strings, which are subsequently visible to authenticated users via IPP Get-Printer-Attributes responses and the CUPS web interface. This vulnerability is fixed in 2.4.17.","status":"published","published":"2026-04-24T17:16:00Z","modified":"2026-07-21T18:35:25.104151623Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T16:56:16.686388Z"},{"id":"AZL-83627","title":"CVE-2026-41079 affecting package cups for versions less than 2.4.18-1","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.17, a network-adjacent attacker can send a crafted SNMP response to the CUPS SNMP backend that causes an out-of-bounds read of up to 176 bytes past a stack buffer. The leaked memory is converted from UTF-16 to UTF-8 and stored as printer supply description strings, which are subsequently visible to authenticated users via IPP Get-Printer-Attributes responses and the CUPS web interface. This vulnerability is fixed in 2.4.17.","status":"published","published":"2026-04-24T17:16:21Z","modified":"2026-08-28T17:56:30.261548Z","updated_at":"2026-11-02T15:28:10.335477Z"},{"id":"CLSA-2026-1777545654","title":"cups: Fix of CVE-2026-41079","description":"- CVE-2026-41079: limit num_bytes for SNMP string values to prevent\n  out-of-bounds read in asn1_decode_snmp","status":"published","published":"2026-04-30T10:40:59Z","modified":"2026-06-01T00:32:50.012205449Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1778234216","title":"cups: Fix of CVE-2026-41079","description":"- CVE-2026-41079: limit num_bytes for SNMP string values to prevent\n  out-of-bounds read in asn1_decode_snmp","status":"published","published":"2026-05-08T09:57:00Z","modified":"2026-06-01T00:32:29.768054512Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"openSUSE-SU-2026:10820-1","title":"cups-2.4.19-2.1 on GA media","description":"These are all security issues fixed in the cups-2.4.19-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-05-20T00:00:00Z","modified":"2026-05-21T08:15:09.179749609Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:20812-1","title":"Security update for cups","description":"This update for cups fixes the following issues\n\n- CVE-2026-27447: Authorization bypass via case-insensitive group-member lookup (bsc#1261572).\n- CVE-2026-34978: Path traversal in RSS notify-recipient-uri enables file write outside CacheDir/rss (bsc#1261571).\n- CVE-2026-34979: Heap overflow in `get_options()` (bsc#1261570).\n- CVE-2026-34980: Shared PostScript queue lets anonymous Print-Job requests reach `lp` code execution over the network\n  (bsc#1261569).\n- CVE-2026-34990: Local print admin token disclosure using temporary printers (bsc#1261568).\n- CVE-2026-39314: negative `job-password-supported` attribute can lead to a denial of service (bsc#1261743).\n- CVE-2026-39316: dangling subscription pointer can lead to a denial of service (bsc#1261742).\n- CVE-2026-41079: crafted SNMP response can lead to stack-based out-of-bounds read and sensitive memory disclosure\n  (bsc#1263116).\n\nChanges for cups:\n\n- Version upgrade to 2.4.19.\n\n- Version upgrade to 2.4.18.\n\n- Version upgrade to 2.4.17:\n\n * The scheduler followed symbolic links when cleaning out\n its temporary directory (Issue #1448)\n * Updated `cupsFileGetConf` and `cupsFilePutConf` to escape\n more characters.\n * Updated man page `cancel` (Issue #984)\n * Updated `cupsRasterReadHeader` to validate more of the\n page header values (Issue #1501)\n * Fixed an issue with the class/printer CGI name checking.\n * Fixed infinite loop in `http_write()` on busy print servers\n (Issue #827)\n * Fixed potential TLS blocking issues (Issue #1128)\n * Fixed a job history bug in the scheduler (Issue #1440)\n * Fixed notifier logging bug that would result in nul bytes\n getting into the log (Issue #1450)\n * Fixed possible use-after-free in `cupsdReadClient()`\n (Issue #1454)\n * Fixed a document format bug in the IPP backend (Issue #1457)\n * Fixed DRAIN_OUTPUT race condition (Issue #1461)\n * Fixed a bug when then `ippFindXxx` and `ippSetXxx` functions\n were mixed.\n * Fixed the mapping of supply type keywords to SNMP names.\n * Fixed a bug in the IPP backend when SNMP was disabled.\n * Fixed a crash bug in the rastertoepson filter.\n * Fixed a bug in cgiCheckVariables.\n * Fixed handling read/write errors with OpenSSL (Issue #1506)\n * Fixed handling rehandshake error in `_httpTLSRead`\n (Issue #1508)\n * Fixed a debug printf bug on Windows (Issue #1529)\n * Fixed a recursion issue with encoding of nested collections\n (Issue #1539)\n * Fixed parsing of the `LimitRequestBody`, `MaxLogSize`,\n and `MaxRequestSize` directives in \"cupsd.conf\" (Issue #1540)\n * Fixed a parsing bug in `ipptool` (Issue #1542)\n * Fixed blank line detection in the `rastertolabel` filter\n (Issue #1545)\n * Fixed `httpPeek` edge case on compressed streams\n","status":"published","published":"2026-05-26T12:19:57Z","modified":"2026-05-29T18:24:10.427785997Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2026:21787-1","title":"Security update for cups","description":"This update for cups fixes the following issues\n\n- CVE-2026-27447: Authorization bypass via case-insensitive group-member lookup (bsc#1261572).\n- CVE-2026-34978: Path traversal in RSS notify-recipient-uri enables file write outside CacheDir/rss (bsc#1261571).\n- CVE-2026-34979: Heap overflow in `get_options()` (bsc#1261570).\n- CVE-2026-34980: Shared PostScript queue lets anonymous Print-Job requests reach `lp` code execution over the network\n  (bsc#1261569).\n- CVE-2026-34990: Local print admin token disclosure using temporary printers (bsc#1261568).\n- CVE-2026-39314: negative `job-password-supported` attribute can lead to a denial of service (bsc#1261743).\n- CVE-2026-39316: dangling subscription pointer can lead to a denial of service (bsc#1261742).\n- CVE-2026-41079: crafted SNMP response can lead to stack-based out-of-bounds read and sensitive memory disclosure\n  (bsc#1263116).\n\nChanges for cups:\n\n- Version upgrade to 2.4.19\n","status":"published","published":"2026-05-26T12:01:22Z","modified":"2026-05-28T18:24:07.160507943Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:21836-1","title":"Security update for cups","description":"This update for cups fixes the following issues\n\n- CVE-2026-27447: Authorization bypass via case-insensitive group-member lookup (bsc#1261572).\n- CVE-2026-34978: Path traversal in RSS notify-recipient-uri enables file write outside CacheDir/rss (bsc#1261571).\n- CVE-2026-34979: Heap overflow in `get_options()` (bsc#1261570).\n- CVE-2026-34980: Shared PostScript queue lets anonymous Print-Job requests reach `lp` code execution over the network\n  (bsc#1261569).\n- CVE-2026-34990: Local print admin token disclosure using temporary printers (bsc#1261568).\n- CVE-2026-39314: negative `job-password-supported` attribute can lead to a denial of service (bsc#1261743).\n- CVE-2026-39316: dangling subscription pointer can lead to a denial of service (bsc#1261742).\n- CVE-2026-41079: crafted SNMP response can lead to stack-based out-of-bounds read and sensitive memory disclosure\n  (bsc#1263116).\n\nChanges for cups:\n\n- Version upgrade to 2.4.19.\n\n- Version upgrade to 2.4.18.\n\n- Version upgrade to 2.4.17:\n\n * The scheduler followed symbolic links when cleaning out\n its temporary directory (Issue #1448)\n * Updated `cupsFileGetConf` and `cupsFilePutConf` to escape\n more characters.\n * Updated man page `cancel` (Issue #984)\n * Updated `cupsRasterReadHeader` to validate more of the\n page header values (Issue #1501)\n * Fixed an issue with the class/printer CGI name checking.\n * Fixed infinite loop in `http_write()` on busy print servers\n (Issue #827)\n * Fixed potential TLS blocking issues (Issue #1128)\n * Fixed a job history bug in the scheduler (Issue #1440)\n * Fixed notifier logging bug that would result in nul bytes\n getting into the log (Issue #1450)\n * Fixed possible use-after-free in `cupsdReadClient()`\n (Issue #1454)\n * Fixed a document format bug in the IPP backend (Issue #1457)\n * Fixed DRAIN_OUTPUT race condition (Issue #1461)\n * Fixed a bug when then `ippFindXxx` and `ippSetXxx` functions\n were mixed.\n * Fixed the mapping of supply type keywords to SNMP names.\n * Fixed a bug in the IPP backend when SNMP was disabled.\n * Fixed a crash bug in the rastertoepson filter.\n * Fixed a bug in cgiCheckVariables.\n * Fixed handling read/write errors with OpenSSL (Issue #1506)\n * Fixed handling rehandshake error in `_httpTLSRead`\n (Issue #1508)\n * Fixed a debug printf bug on Windows (Issue #1529)\n * Fixed a recursion issue with encoding of nested collections\n (Issue #1539)\n * Fixed parsing of the `LimitRequestBody`, `MaxLogSize`,\n and `MaxRequestSize` directives in \"cupsd.conf\" (Issue #1540)\n * Fixed a parsing bug in `ipptool` (Issue #1542)\n * Fixed blank line detection in the `rastertolabel` filter\n (Issue #1545)\n * Fixed `httpPeek` edge case on compressed streams\n","status":"published","published":"2026-05-26T12:30:35Z","modified":"2026-05-31T18:24:29.118006865Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:21850-1","title":"Security update for cups","description":"This update for cups fixes the following issues\n\n- CVE-2026-27447: Authorization bypass via case-insensitive group-member lookup (bsc#1261572).\n- CVE-2026-34978: Path traversal in RSS notify-recipient-uri enables file write outside CacheDir/rss (bsc#1261571).\n- CVE-2026-34979: Heap overflow in `get_options()` (bsc#1261570).\n- CVE-2026-34980: Shared PostScript queue lets anonymous Print-Job requests reach `lp` code execution over the network\n  (bsc#1261569).\n- CVE-2026-34990: Local print admin token disclosure using temporary printers (bsc#1261568).\n- CVE-2026-39314: negative `job-password-supported` attribute can lead to a denial of service (bsc#1261743).\n- CVE-2026-39316: dangling subscription pointer can lead to a denial of service (bsc#1261742).\n- CVE-2026-41079: crafted SNMP response can lead to stack-based out-of-bounds read and sensitive memory disclosure\n  (bsc#1263116).\n\nChanges for cups:\n\n- Version upgrade to 2.4.19.\n\n- Version upgrade to 2.4.18.\n\n- Version upgrade to 2.4.17:\n\n * The scheduler followed symbolic links when cleaning out\n its temporary directory (Issue #1448)\n * Updated `cupsFileGetConf` and `cupsFilePutConf` to escape\n more characters.\n * Updated man page `cancel` (Issue #984)\n * Updated `cupsRasterReadHeader` to validate more of the\n page header values (Issue #1501)\n * Fixed an issue with the class/printer CGI name checking.\n * Fixed infinite loop in `http_write()` on busy print servers\n (Issue #827)\n * Fixed potential TLS blocking issues (Issue #1128)\n * Fixed a job history bug in the scheduler (Issue #1440)\n * Fixed notifier logging bug that would result in nul bytes\n getting into the log (Issue #1450)\n * Fixed possible use-after-free in `cupsdReadClient()`\n (Issue #1454)\n * Fixed a document format bug in the IPP backend (Issue #1457)\n * Fixed DRAIN_OUTPUT race condition (Issue #1461)\n * Fixed a bug when then `ippFindXxx` and `ippSetXxx` functions\n were mixed.\n * Fixed the mapping of supply type keywords to SNMP names.\n * Fixed a bug in the IPP backend when SNMP was disabled.\n * Fixed a crash bug in the rastertoepson filter.\n * Fixed a bug in cgiCheckVariables.\n * Fixed handling read/write errors with OpenSSL (Issue #1506)\n * Fixed handling rehandshake error in `_httpTLSRead`\n (Issue #1508)\n * Fixed a debug printf bug on Windows (Issue #1529)\n * Fixed a recursion issue with encoding of nested collections\n (Issue #1539)\n * Fixed parsing of the `LimitRequestBody`, `MaxLogSize`,\n and `MaxRequestSize` directives in \"cupsd.conf\" (Issue #1540)\n * Fixed a parsing bug in `ipptool` (Issue #1542)\n * Fixed blank line detection in the `rastertolabel` filter\n (Issue #1545)\n * Fixed `httpPeek` edge case on compressed streams\n","status":"published","published":"2026-05-26T12:30:35Z","modified":"2026-06-02T18:24:27.004963474Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:21871-1","title":"Security update for cups","description":"This update for cups fixes the following issues\n\n- CVE-2026-27447: Authorization bypass via case-insensitive group-member lookup (bsc#1261572).\n- CVE-2026-34978: Path traversal in RSS notify-recipient-uri enables file write outside CacheDir/rss (bsc#1261571).\n- CVE-2026-34979: Heap overflow in `get_options()` (bsc#1261570).\n- CVE-2026-34980: Shared PostScript queue lets anonymous Print-Job requests reach `lp` code execution over the network\n  (bsc#1261569).\n- CVE-2026-34990: Local print admin token disclosure using temporary printers (bsc#1261568).\n- CVE-2026-39314: negative `job-password-supported` attribute can lead to a denial of service (bsc#1261743).\n- CVE-2026-39316: dangling subscription pointer can lead to a denial of service (bsc#1261742).\n- CVE-2026-41079: crafted SNMP response can lead to stack-based out-of-bounds read and sensitive memory disclosure\n  (bsc#1263116).\n\nChanges for cups:\n\n- Version upgrade to 2.4.19\n","status":"published","published":"2026-05-26T11:41:50Z","modified":"2026-06-03T18:24:32.09614154Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:4447-1","title":"Security update for cups","description":"This update for cups fixes the following issue:\n\n- CVE-2026-41079: crafted SNMP response can lead to stack-based out-of-bounds read and sensitive memory disclosure\n  (bsc#1263116).\n","status":"published","published":"2026-10-05T08:21:08Z","modified":"2026-10-05T18:00:05.557036538Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:5078-1","title":"Security update for cups","description":"This update for cups fixes the following issues:\n\n- CVE-2026-41079: crafted SNMP response can lead to stack-based out-of-bounds read and sensitive memory disclosure\n  (bsc#1263116).\n- CVE-2026-105326: argument injection in `mailto` notifier allows unauthenticated remote code execution (bsc#1284274).\n","status":"published","published":"2026-11-03T08:22:38Z","modified":"2026-11-03T22:45:04.114198493Z","updated_at":"2026-11-03T22:59:30.419462Z"},{"id":"USN-8405-1","title":"cups vulnerabilities","description":"Ariel Silver discovered that CUPS incorrectly handled username comparisons\nduring authorization checks. A local attacker could possibly use this issue\nto gain unauthorized access to restricted operations. (CVE-2026-27447)\n\nAsim Viladi Oglu Manizada discovered that CUPS incorrectly handled\nnotify-recipient-uri values in the RSS notifier. A remote attacker could\npossibly use this issue to overwrite lp-writable files and cause a denial\nof service. (CVE-2026-34978)\n\nJacob Newman discovered that CUPS incorrectly handled filter option strings\nwhen processing job attributes. An attacker could use this issue to cause\nCUPS to crash, resulting in a denial of service, or possibly execute\narbitrary code. (CVE-2026-34979)\n\nAsim Viladi Oglu Manizada discovered that CUPS incorrectly handled\npage-border values in shared PostScript queues. A remote attacker could\npossibly use this issue to execute arbitrary code. (CVE-2026-34980)\n\nAsim Viladi Oglu Manizada discovered that CUPS incorrectly handled\nlocalhost authentication to attacker-controlled IPP services. A local\nattacker could possibly use this issue to overwrite arbitrary files\nand execute arbitrary code. (CVE-2026-34990)\n\nTomer Fichman discovered that CUPS incorrectly handled negative\njob-password-supported values. A local attacker could possibly use this\nissue to cause CUPS to crash, resulting in a denial of service.\n(CVE-2026-39314)\n\nTomer Fichman discovered that CUPS incorrectly handled temporary printer\ndeletion. An attacker could possibly use this issue to cause CUPS to crash,\nresulting in a denial of service, or to execute arbitrary code.\n(CVE-2026-39316)\n\nTomer Fichman discovered that CUPS incorrectly handled certain malformed\nSNMP responses. An attacker could possibly use this issue to obtain\nsensitive information. (CVE-2026-41079)","status":"published","published":"2026-06-08T15:51:32Z","modified":"2026-06-08T23:14:21.292502385Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}