CVE-2026-55467

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-55467", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-16T22:10:37.608Z", "datePublished": "2026-10-15T17:08:24.374Z", "dateUpdated": "2026-10-15T17:49:26.673Z"}, "containers": {"cna": {"title": "CUPS fax option values bypass the CVE-2026-34980 control-character sanitizer (incomplete fix)", "problemTypes": [{"descriptions": [{"cweId": "CWE-93", "lang": "en", "description": "CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-94", "lang": "en", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-150", "lang": "en", "description": "CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 2.5, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/OpenPrinting/cups/security/advisories/GHSA-69qc-prxg-h2c7", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/OpenPrinting/cups/security/advisories/GHSA-69qc-prxg-h2c7"}, {"name": "https://github.com/OpenPrinting/cups/commit/0cf4e7814d6810ed3c454222bce3aa342d541681", "tags": ["x_refsource_MISC"], "url": "https://github.com/OpenPrinting/cups/commit/0cf4e7814d6810ed3c454222bce3aa342d541681"}, {"name": "https://github.com/OpenPrinting/cups/commit/a9e7e7a3a019d0fa063d29409d3f82e4c6d5a008", "tags": ["x_refsource_MISC"], "url": "https://github.com/OpenPrinting/cups/commit/a9e7e7a3a019d0fa063d29409d3f82e4c6d5a008"}, {"name": "https://github.com/OpenPrinting/cups/releases/tag/v2.4.20", "tags": ["x_refsource_MISC"], "url": "https://github.com/OpenPrinting/cups/releases/tag/v2.4.20"}], "affected": [{"vendor": "OpenPrinting", "product": "cups", "versions": [{"version": "< 2.4.20", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-15T17:08:24.374Z"}, "descriptions": [{"lang": "en", "value": "OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the cupsdCreateJob option-string builder in scheduler/job.c maps attacker-controlled destination-uri and pre-dial-string values from a configured fax queue to the phone and faxPrefix options. Unlike ordinary IPP job attributes, these mapped fax values bypass the control-character sanitizer and are copied directly into the filter options argument. A user permitted to submit a job can therefore inject control characters into the downstream option stream. The reporter states that a downstream fax filter passing these values to a shell or modem command could execute code as lp, while the maintainer states that CUPS has no confidentiality or integrity impact because the only known code-executing filter is optional Foomatic and addressed separately, leaving possible disruption of the affected queue. This issue is fixed in version 2.4.20."}], "source": {"advisory": "GHSA-69qc-prxg-h2c7", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/OpenPrinting/cups/security/advisories/GHSA-69qc-prxg-h2c7", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-15T17:49:04.144102Z", "id": "CVE-2026-55467", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T17:49:26.673Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-55467", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-15T17:49:04.144102Z"}}}], "references": [{"url": "https://github.com/OpenPrinting/cups/security/advisories/GHSA-69qc-prxg-h2c7", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T17:49:18.871Z"}}], "cna": {"title": "CUPS fax option values bypass the CVE-2026-34980 control-character sanitizer (incomplete fix)", "source": {"advisory": "GHSA-69qc-prxg-h2c7", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.5, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "OpenPrinting", "product": "cups", "versions": [{"status": "affected", "version": "< 2.4.20"}]}], "references": [{"url": "https://github.com/OpenPrinting/cups/security/advisories/GHSA-69qc-prxg-h2c7", "name": "https://github.com/OpenPrinting/cups/security/advisories/GHSA-69qc-prxg-h2c7", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/OpenPrinting/cups/commit/0cf4e7814d6810ed3c454222bce3aa342d541681", "name": "https://github.com/OpenPrinting/cups/commit/0cf4e7814d6810ed3c454222bce3aa342d541681", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/OpenPrinting/cups/commit/a9e7e7a3a019d0fa063d29409d3f82e4c6d5a008", "name": "https://github.com/OpenPrinting/cups/commit/a9e7e7a3a019d0fa063d29409d3f82e4c6d5a008", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/OpenPrinting/cups/releases/tag/v2.4.20", "name": "https://github.com/OpenPrinting/cups/releases/tag/v2.4.20", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the cupsdCreateJob option-string builder in scheduler/job.c maps attacker-controlled destination-uri and pre-dial-string values from a configured fax queue to the phone and faxPrefix options. Unlike ordinary IPP job attributes, these mapped fax values bypass the control-character sanitizer and are copied directly into the filter options argument. A user permitted to submit a job can therefore inject control characters into the downstream option stream. The reporter states that a downstream fax filter passing these values to a shell or modem command could execute code as lp, while the maintainer states that CUPS has no confidentiality or integrity impact because the only known code-executing filter is optional Foomatic and addressed separately, leaving possible disruption of the affected queue. This issue is fixed in version 2.4.20."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-93", "description": "CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-150", "description": "CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-15T17:08:24.374Z"}}}, "cveMetadata": {"cveId": "CVE-2026-55467", "state": "PUBLISHED", "dateUpdated": "2026-10-15T17:49:26.673Z", "dateReserved": "2026-06-16T22:10:37.608Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-10-15T17:08:24.374Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "cups", "vendor": "OpenPrinting", "versions": [{"status": "affected", "version": "< 2.4.20"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:openprinting:cups:*:*:*:*:*:*:*:*", "matchCriteriaId": "2DB4F8BB-D97C-48D4-9B6F-F18BF8CC6E83", "versionEndExcluding": "2.4.20", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the cupsdCreateJob option-string builder in scheduler/job.c maps attacker-controlled destination-uri and pre-dial-string values from a configured fax queue to the phone and faxPrefix options. Unlike ordinary IPP job attributes, these mapped fax values bypass the control-character sanitizer and are copied directly into the filter options argument. A user permitted to submit a job can therefore inject control characters into the downstream option stream. The reporter states that a downstream fax filter passing these values to a shell or modem command could execute code as lp, while the maintainer states that CUPS has no confidentiality or integrity impact because the only known code-executing filter is optional Foomatic and addressed separately, leaving possible disruption of the affected queue. This issue is fixed in version 2.4.20."}], "id": "CVE-2026-55467", "lastModified": "2026-10-20T19:37:48.443", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 2.5, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-55467", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T17:49:04.144102Z", "version": "2.0.3"}}]}, "published": "2026-10-15T18:17:27.833", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/OpenPrinting/cups/commit/0cf4e7814d6810ed3c454222bce3aa342d541681"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/OpenPrinting/cups/commit/a9e7e7a3a019d0fa063d29409d3f82e4c6d5a008"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/OpenPrinting/cups/releases/tag/v2.4.20"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/OpenPrinting/cups/security/advisories/GHSA-69qc-prxg-h2c7"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/OpenPrinting/cups/security/advisories/GHSA-69qc-prxg-h2c7"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-93"}, {"lang": "en", "value": "CWE-94"}, {"lang": "en", "value": "CWE-150"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{"bugzilla": {"description": "cups: cups: Denial of Service via unsanitized fax job attributes", "id": "2553617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553617"}, "csaw": false, "cvss3": {"cvss3_base_score": "2.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-88", "details": ["A flaw was found in CUPS. This vulnerability allows an authorized user to cause a Denial of Service (DoS) by submitting print jobs containing specially crafted fax queue attributes. Because certain fax parameters bypass input sanitization when passed to downstream processing filters, an attacker can inject control characters into the filter option stream. This can disrupt the operation of the affected print queue or trigger unintended behavior in downstream filters."], "name": "CVE-2026-55467", "package_state": [{"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "cups", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-10-15T17:08:24Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-55467\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-55467\nhttps://github.com/OpenPrinting/cups/commit/0cf4e7814d6810ed3c454222bce3aa342d541681\nhttps://github.com/OpenPrinting/cups/commit/a9e7e7a3a019d0fa063d29409d3f82e4c6d5a008\nhttps://github.com/OpenPrinting/cups/releases/tag/v2.4.20\nhttps://github.com/OpenPrinting/cups/security/advisories/GHSA-69qc-prxg-h2c7"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.4.20)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "cups", "source": "cna", "vendor": "OpenPrinting"}, "product": "cups", "vendor": "openprinting"}], "created": "2026-10-16T07:15:17.907976+00:00", "updated": "2026-10-17T19:00:13.241401+00:00", "vendors": ["openprinting", "openprinting$PRODUCT$cups"]}