https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 19 Oct 2026 03:11:02 +0000 https://cve.radiocsirt.org/vuln/bell-cve-2026-107890 <p><strong>Affected:</strong> Alpaquita:23: cups, Alpaquita:25: cups, Alpaquita:stream: cups</p> <p><strong>Affected:</strong> Alpaquita:23: cups, Alpaquita:25: cups, Alpaquita:stream: cups</p> https://cve.radiocsirt.org/vuln/bell-cve-2026-107890 https://cve.radiocsirt.org/vuln/euvd-2026-384939 EUVD-2026-384939 https://cve.radiocsirt.org/vuln/euvd-2026-384939 https://cve.radiocsirt.org/vuln/fkie_cve-2026-107890 <p>OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation requests. IPP parsing creates unnamed separator attributes with IPP_TAG_ZERO, but add_job() converts these separators to IPP_TAG_JOB. During job startup, get_options()/ipp_length() subsequently calls strlen() on a NULL attribute name, terminating cupsd and disrupting all queues. A single crafted Print-Job request can trigger the crash when the client can reach the scheduler and submit jobs to an accepting, enabled queue supporting the submitted document format. Anonymous submission is possible when permitted by listener and access-control configuration.</p> <p>OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation requests. IPP parsing creates unnamed separator attributes with IPP_TAG_ZERO, but add_job() converts these separators to IPP_TAG_JOB. During job startup, get_options()/ipp_length() subsequently calls strlen() on a NULL attribute name, terminating cupsd and disrupting all queues. A single crafted Print-Job request can trigger the crash when the client can reach the scheduler and submit jobs to an accepting, enabled queue supporting the submitted document format. Anonymous submission is possible when permitted by listener and access-control configuration.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-107890 https://cve.radiocsirt.org/vuln/ghsa-q6rw-m9p2-pjq2 <p>OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation requests. IPP parsing creates unnamed separator attributes with IPP_TAG_ZERO, but add_job() converts these separators to IPP_TAG_JOB. During job startup, get_options()/ipp_length() subsequently calls strlen() on a NULL attribute name, terminating cupsd and disrupting all queues. A single crafted Print-Job request can trigger the crash when the client can reach the scheduler and submit jobs to an accepting, enabled queue supporting the submitted document format. Anonymous submission is possible when permitted by listener and access-control configuration.</p> <p>OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation requests. IPP parsing creates unnamed separator attributes with IPP_TAG_ZERO, but add_job() converts these separators to IPP_TAG_JOB. During job startup, get_options()/ipp_length() subsequently calls strlen() on a NULL attribute name, terminating cupsd and disrupting all queues. A single crafted Print-Job request can trigger the crash when the client can reach the scheduler and submit jobs to an accepting, enabled queue supporting the submitted document format. Anonymous submission is possible when permitted by listener and access-control configuration.</p> https://cve.radiocsirt.org/vuln/ghsa-q6rw-m9p2-pjq2 https://cve.radiocsirt.org/vuln/rhsa-2026:81410 <p>cups: cups: Denial of Service via improper job submission timeout handling cups: cups: Denial of Service via double-free in printer class management cups: CUPS: Denial of Service via deleted temporary printer cups: cups: Denial of Service via repeated IPP group tags</p> <p>cups: cups: Denial of Service via improper job submission timeout handling cups: cups: Denial of Service via double-free in printer class management cups: CUPS: Denial of Service via deleted temporary printer cups: cups: Denial of Service via repeated IPP group tags</p> https://cve.radiocsirt.org/vuln/rhsa-2026:81410 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-107890 <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: cups, Ubuntu:Pro:18.04:LTS: cups, Ubuntu:Pro:20.04:LTS: cups, Ubuntu:22.04:LTS: cups, Ubuntu:24.04:LTS: cups, Ubuntu:26.10: cups, Ubuntu:26.04:LTS: cups</p> <p>OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation requests. IPP parsing creates unnamed separator attributes with IPP_TAG_ZERO, but add_job() converts these separators to IPP_TAG_JOB. During job startup, get_options()/ipp_length() subsequently calls strlen() on a NULL attribute name, terminating cupsd and disrupting all queues. A single crafted Print-Job request can trigger the crash when the client can reach the scheduler and submit jobs to an accepting, enabled queue supporting the submitted document format. Anonymous submission is possible when permitted by listener and access-control configuration.</p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: cups, Ubuntu:Pro:18.04:LTS: cups, Ubuntu:Pro:20.04:LTS: cups, Ubuntu:22.04:LTS: cups, Ubuntu:24.04:LTS: cups, Ubuntu:26.10: cups, Ubuntu:26.04:LTS: cups</p> <p>OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation requests. IPP parsing creates unnamed separator attributes with IPP_TAG_ZERO, but add_job() converts these separators to IPP_TAG_JOB. During job startup, get_options()/ipp_length() subsequently calls strlen() on a NULL attribute name, terminating cupsd and disrupting all queues. A single crafted Print-Job request can trigger the crash when the client can reach the scheduler and submit jobs to an accepting, enabled queue supporting the submitted document format. Anonymous submission is possible when permitted by listener and access-control configuration.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-107890