CVE-2026-107890
published 2026-10-09CVE-2026-107890: OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation requests. IPP parsing creates unnamed…
PriorityP423medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.10%
1.0th percentile
OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation requests. IPP parsing creates unnamed separator attributes with IPP_TAG_ZERO, but add_job() converts these separators to IPP_TAG_JOB. During job startup, get_options()/ipp_length() subsequently calls strlen() on a NULL attribute name, terminating cupsd and disrupting all queues. A single crafted Print-Job request can trigger the crash when the client can reach the scheduler and submit jobs to an accepting, enabled queue supporting the submitted document format. Anonymous submission is possible when permitted by listener and access-control configuration.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | cups | — | — |
| openprinting | cups | < 2.4.20 | 2.4.20 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vendor_redhat3.3LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
cups: cups: Denial of Service via repeated IPP group tags
vendor_redhat·2026-10-09·CVSS 3.3
CVE-2026-107890 [LOW] CWE-476 cups: cups: Denial of Service via repeated IPP group tags
cups: cups: Denial of Service via repeated IPP group tags
A flaw was found in CUPS. An attacker who can submit print jobs can exploit this issue by sending a crafted request containing repeated Internet Printing Protocol (IPP) group tags. This triggers a NULL pointer dereference during job processing, causing the print scheduler daemon (cupsd) to crash and resulting in a Denial of Service (DoS) across all print queues.
Package: cups (Red Hat Enterprise Linux 10) - Fix deferred
Package: cups (Red Hat Enterprise Linux 6) - Out of support scope
Package: cups (Red Hat Enterprise Linux 7) - Fix deferred
Package: cups (Red Hat Enterprise Linux 8) - Fix deferred
Package: cups (Red Hat Enterprise Linux 9) - Fix deferred
Package: cups (Red Hat Hardened Images) - Affected
GHSA
OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation requests.
ghsa_unreviewed·2026-10-09
CVE-2026-107890 [LOW] CWE-476 OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation requests.
OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation requests. IPP parsing creates unnamed separator attributes with IPP_TAG_ZERO, but add_job() converts these separators to IPP_TAG_JOB. During job startup, get_options()/ipp_length() subsequently calls strlen() on a NULL attribute name, terminating cupsd and disrupting all queues. A single crafted Print-Job request can trigger the crash when the client can reach the scheduler and submit jobs to an accepting, enabled queue supporting the submitted document format. Anonymous submission is possible when permitted by listener and access-control configuration.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-107890 cups: cups: Denial of Service via repeated IPP group tags
bugzilla·2026-10-09·CVSS 3.3
CVE-2026-107890 [LOW] CVE-2026-107890 cups: cups: Denial of Service via repeated IPP group tags
CVE-2026-107890 cups: cups: Denial of Service via repeated IPP group tags
OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation requests. IPP parsing creates unnamed separator attributes with IPP_TAG_ZERO, but add_job() converts these separators to IPP_TAG_JOB. During job startup, get_options()/ipp_length() subsequently calls strlen() on a NULL attribute name, terminating cupsd and disrupting all queues. A single crafted Print-Job request can trigger the crash when the client can reach the scheduler and submit jobs to an accepting, enabled queue supporting the submitted document format. Anonymous submission is possible when permitted by listener and access-control configuration.
Bugzilla
CVE-2026-107890 cups: cups: Denial of Service via repeated IPP group tags [fedora-all]
bugzilla·2026-10-09·CVSS 3.3
CVE-2026-107890 [LOW] CVE-2026-107890 cups: cups: Denial of Service via repeated IPP group tags [fedora-all]
CVE-2026-107890 cups: cups: Denial of Service via repeated IPP group tags [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation requests. IPP parsing creates unnamed separator attributes with IPP_TAG_ZERO, but add_job() converts these separators to IPP_TAG_JOB. During job startup, get_options()/ipp_length() subsequently calls strlen() on a NULL attribute name, terminating cupsd and disrupting all queues. A single crafted Print-Job request can trigger the crash when the client can reach the sc
2026-10-09
Published