CVE-2026-107885
published 2026-10-09CVE-2026-107885: OpenPrinting CUPS through 2.4.20 contains a resource-exhaustion vulnerability in the submission-timeout handling of cupsdCheckJobs(). The scheduler suppresses…
PriorityP422medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.10%
1.0th percentile
OpenPrinting CUPS through 2.4.20 contains a resource-exhaustion vulnerability in the submission-timeout handling of cupsdCheckJobs(). The scheduler suppresses timeout processing for all pending jobs whenever any client connection has an in-flight Send-Document operation, without matching that connection to the job being examined. A client allowed to reach the IPP service can hold an incomplete HTTP request containing parsed Send-Document headers before operation authorization, preventing unrelated incomplete jobs from expiring. Where Create-Job submission is allowed, incomplete jobs can accumulate until MaxJobs is exhausted and further legitimate print submissions are rejected. The suppression ends when the held connection closes.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | cups | — | — |
| openprinting | cups | < 2.4.21 | 2.4.21 |
| openprinting | cups | <= 2.4.20 | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vendor_redhat3.3LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
cups: cups: Denial of Service via improper job submission timeout handling
vendor_redhat·2026-10-09·CVSS 3.3
CVE-2026-107885 [LOW] CWE-772 cups: cups: Denial of Service via improper job submission timeout handling
cups: cups: Denial of Service via improper job submission timeout handling
A flaw was found in cups. An attacker with network access to the Internet Printing Protocol (IPP) service can cause a Denial of Service (DoS) by initiating a document submission request and keeping the connection open without completing it. The print scheduler globally pauses timeout processing for all jobs while any document transfer is active, preventing abandoned jobs from expiring. An attacker can repeatedly submit incomplete jobs until the system's job limit is reached, causing legitimate print requests to be rejected.
Package: cups (Red Hat Enterprise Linux 10) - Fix deferred
Package: cups (Red Hat Enterprise Linux 6) - Out of support scope
Package: cups (Red Hat Enterprise Linux 7) - Fix deferred
Package
GHSA
OpenPrinting CUPS through 2.4.20 contains a resource-exhaustion vulnerability in the submission-timeout handling of cupsdCheckJobs().
ghsa_unreviewed·2026-10-09
CVE-2026-107885 [LOW] CWE-770 OpenPrinting CUPS through 2.4.20 contains a resource-exhaustion vulnerability in the submission-timeout handling of cupsdCheckJobs().
OpenPrinting CUPS through 2.4.20 contains a resource-exhaustion vulnerability in the submission-timeout handling of cupsdCheckJobs(). The scheduler suppresses timeout processing for all pending jobs whenever any client connection has an in-flight Send-Document operation, without matching that connection to the job being examined. A client allowed to reach the IPP service can hold an incomplete HTTP request containing parsed Send-Document headers before operation authorization, preventing unrelated incomplete jobs from expiring. Where Create-Job submission is allowed, incomplete jobs can accumulate until MaxJobs is exhausted and further legitimate print submissions are rejected. The suppression ends when the held connection closes.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-107885 cups: cups: Denial of Service via improper job submission timeout handling [fedora-all]
bugzilla·2026-10-09·CVSS 3.3
CVE-2026-107885 [LOW] CVE-2026-107885 cups: cups: Denial of Service via improper job submission timeout handling [fedora-all]
CVE-2026-107885 cups: cups: Denial of Service via improper job submission timeout handling [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
OpenPrinting CUPS through 2.4.20 contains a resource-exhaustion vulnerability in the submission-timeout handling of cupsdCheckJobs(). The scheduler suppresses timeout processing for all pending jobs whenever any client connection has an in-flight Send-Document operation, without matching that connection to the job being examined. A client allowed to reach the IPP service can hold an incomplete HTTP request containing parsed Send-Document headers before operation aut
Bugzilla
CVE-2026-107885 cups: cups: Denial of Service via improper job submission timeout handling
bugzilla·2026-10-09·CVSS 3.3
CVE-2026-107885 [LOW] CVE-2026-107885 cups: cups: Denial of Service via improper job submission timeout handling
CVE-2026-107885 cups: cups: Denial of Service via improper job submission timeout handling
OpenPrinting CUPS through 2.4.20 contains a resource-exhaustion vulnerability in the submission-timeout handling of cupsdCheckJobs(). The scheduler suppresses timeout processing for all pending jobs whenever any client connection has an in-flight Send-Document operation, without matching that connection to the job being examined. A client allowed to reach the IPP service can hold an incomplete HTTP request containing parsed Send-Document headers before operation authorization, preventing unrelated incomplete jobs from expiring. Where Create-Job submission is allowed, incomplete jobs can accumulate until MaxJobs is exhausted and further legitimate print submissions are rejected. The suppression ends
2026-10-09
Published