Source: cups Version: 2.4.18-1 X-Debbugs-CC: [email protected] Severity: important Tags: security upstream
Hi, The following vulnerability was published for cups. CVE-2026-107885[0]: | OpenPrinting CUPS through 2.4.20 contains a resource-exhaustion | vulnerability in the submission-timeout handling of | cupsdCheckJobs(). The scheduler suppresses timeout processing for | all pending jobs whenever any client connection has an in-flight | Send-Document operation, without matching that connection to the job | being examined. A client allowed to reach the IPP service can hold | an incomplete HTTP request containing parsed Send-Document headers | before operation authorization, preventing unrelated incomplete jobs | from expiring. Where Create-Job submission is allowed, incomplete | jobs can accumulate until MaxJobs is exhausted and further | legitimate print submissions are rejected. The suppression ends when | the held connection closes. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-107885 https://www.cve.org/CVERecord?id=CVE-2026-107885 [1] https://github.com/OpenPrinting/cups/security/advisories/GHSA-hhw5-qqmc-p6rg Please adjust the affected versions in the BTS as needed. Regards, Salvatore
