Summary
Johannes Meixner and Paul Zirnik discovered that CUPS incorrectly handled
clients that send messages slowly. A remote attacker could possibly use
this issue to cause CUPS to stop responding, resulting in a denial of
service. (CVE-2025-58436)
In addition, this update fixes a regression introduced in USN-7897-1 which
resulted in certain invalid configuration file directives to cause the CUPS
daemon to fail to start.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | cups | 2.4.1op1-1ubuntu4.16 |
| Ubuntu · 24.04 LTS 24.04:LTS | cups | 2.4.7-1.2ubuntu7.9 |
| Ubuntu · 25.10 | cups | 2.4.12-0ubuntu3.5 |
Vulnerabilities 1
-
Medium 5.1
OpenPrinting CUPS slow client can halt cupsd, leading to a possible DoS attack
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a client that connects to cupsd but sends slow messages, e.g. only one byte per second, delays cupsd as a whole, such that it becomes…