RHSA-2026:84421
Vulnerability from csaf_redhat - Published: 2026-10-17 17:48 - Updated: 2026-10-30 06:54Summary
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
Severity
Important
Notes
Topic: An update for Red Hat Hardened Images RPMs is now available.
Details: This update includes the following RPMs:
cups:
* cups-2.4.19-4.6.hum1 (aarch64, s390x, x86_64)
* cups-client-2.4.19-4.6.hum1 (aarch64, s390x, x86_64)
* cups-devel-2.4.19-4.6.hum1 (aarch64, s390x, x86_64)
* cups-filesystem-2.4.19-4.6.hum1 (noarch)
* cups-ipptool-2.4.19-4.6.hum1 (aarch64, s390x, x86_64)
* cups-libs-2.4.19-4.6.hum1 (aarch64, s390x, x86_64)
* cups-lpd-2.4.19-4.6.hum1 (aarch64, s390x, x86_64)
* cups-printerapp-2.4.19-4.6.hum1 (aarch64, s390x, x86_64)
* cups-2.4.19-4.6.hum1.src (src)
Security Fix(es):
cups:
* CVE-2026-55453
* CVE-2026-61702
* CVE-2026-55480
* CVE-2026-55467
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in CUPS. A remote attacker controlling a network printer can achieve arbitrary code execution by returning crafted printer status messages containing newline characters. The CUPS Internet Printing Protocol (IPP) backend fails to sanitize line breaks in status attributes, allowing injected control directives to be processed by the printing scheduler. These injected directives modify local printer configuration files, causing subsequent print jobs to execute arbitrary commands with the privileges of the print service account.
7.5 (High)
Affected products
Fixed
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:cups-0:2.4.19-4.6.hum1@aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:cups-0:2.4.19-4.6.hum1@s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:cups-0:2.4.19-4.6.hum1@src | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:cups-0:2.4.19-4.6.hum1@x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:cups-client-0:2.4.19-4.6.hum1@aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:cups-client-0:2.4.19-4.6.hum1@s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:cups-client-0:2.4.19-4.6.hum1@x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:cups-devel-0:2.4.19-4.6.hum1@aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:cups-devel-0:2.4.19-4.6.hum1@s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:cups-devel-0:2.4.19-4.6.hum1@x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:cups-filesystem-0:2.4.19-4.6.hum1@noarch@public-hummingbird-aarch64-rpms | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:cups-filesystem-0:2.4.19-4.6.hum1@noarch@public-hummingbird-s390x-rpms | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:cups-filesystem-0:2.4.19-4.6.hum1@noarch@public-hummingbird-x86_64-rpms | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:cups-ipptool-0:2.4.19-4.6.hum1@aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:cups-ipptool-0:2.4.19-4.6.hum1@s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:cups-ipptool-0:2.4.19-4.6.hum1@x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:cups-libs-0:2.4.19-4.6.hum1@aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:cups-libs-0:2.4.19-4.6.hum1@s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:cups-libs-0:2.4.19-4.6.hum1@x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:cups-lpd-0:2.4.19-4.6.hum1@aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:cups-lpd-0:2.4.19-4.6.hum1@s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:cups-lpd-0:2.4.19-4.6.hum1@x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:cups-printerapp-0:2.4.19-4.6.hum1@aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:cups-printerapp-0:2.4.19-4.6.hum1@s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:cups-printerapp-0:2.4.19-4.6.hum1@x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in CUPS. This vulnerability allows an authorized user to cause a Denial of Service (DoS) by submitting print jobs containing specially crafted fax queue attributes. Because certain fax parameters bypass input sanitization when passed to downstream processing filters, an attacker can inject control characters into the filter option stream. This can disrupt the operation of the affected print queue or trigger unintended behavior in downstream filters.
CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')Affected products
Fixed
25 products, the same list as for
CVE-2026-55453
Threats
Impact
Low
A flaw was found in CUPS. Insecure temporary file handling allows a local attacker with print administrative privileges to overwrite arbitrary system files. When configuring a printer, the print service creates a temporary file with a predictable name in a shared directory without verifying whether the file is a symbolic link (symlink). By creating a symlink targeting a sensitive file before the service opens it, an attacker can cause the privileged service to truncate or overwrite that file, leading to data corruption, service disruption, or privilege escalation.
5.7 (Medium)
Affected products
Fixed
25 products, the same list as for
CVE-2026-55453
Threats
Impact
Moderate
A flaw was found in CUPS. An information disclosure vulnerability allows an attacker to read files on the system by submitting a specially crafted print job containing directory traversal characters in the language attribute. Because the scheduler fails to validate path separators when processing banner pages, it can open files accessible to the root process and copy their contents into print spool objects delivered to an attacker-controlled destination.
5.3 (Medium)
Affected products
Fixed
25 products, the same list as for
CVE-2026-55453
Threats
Impact
Moderate
References
37 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for Red Hat Hardened Images RPMs is now available.",
"title": "Topic"
},
{
"category": "general",
"text": "This update includes the following RPMs:\n\ncups:\n * cups-2.4.19-4.6.hum1 (aarch64, s390x, x86_64)\n * cups-client-2.4.19-4.6.hum1 (aarch64, s390x, x86_64)\n * cups-devel-2.4.19-4.6.hum1 (aarch64, s390x, x86_64)\n * cups-filesystem-2.4.19-4.6.hum1 (noarch)\n * cups-ipptool-2.4.19-4.6.hum1 (aarch64, s390x, x86_64)\n * cups-libs-2.4.19-4.6.hum1 (aarch64, s390x, x86_64)\n * cups-lpd-2.4.19-4.6.hum1 (aarch64, s390x, x86_64)\n * cups-printerapp-2.4.19-4.6.hum1 (aarch64, s390x, x86_64)\n * cups-2.4.19-4.6.hum1.src (src)\n\nSecurity Fix(es):\n\ncups:\n * CVE-2026-55453\n * CVE-2026-61702\n * CVE-2026-55480\n * CVE-2026-55467",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:84421",
"url": "https://access.redhat.com/errata/RHSA-2026:84421"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-55453",
"url": "https://access.redhat.com/security/cve/CVE-2026-55453"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-55467",
"url": "https://access.redhat.com/security/cve/CVE-2026-55467"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-55480",
"url": "https://access.redhat.com/security/cve/CVE-2026-55480"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-61702",
"url": "https://access.redhat.com/security/cve/CVE-2026-61702"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://images.redhat.com/",
"url": "https://images.redhat.com/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_84421.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
"tracking": {
"current_release_date": "2026-10-30T06:54:41+00:00",
"generator": {
"date": "2026-10-30T06:54:41+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.4.3"
}
},
"id": "RHSA-2026:84421",
"initial_release_date": "2026-10-17T17:48:21+00:00",
"revision_history": [
{
"date": "2026-10-17T17:48:21+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-10-17T17:51:08+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-10-30T06:54:41+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Hardened Images",
"product": {
"name": "Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:hummingbird:1"
}
}
}
],
"category": "product_family",
"name": "Red Hat Hardened Images"
},
{
"branches": [
{
"category": "product_version",
"name": "cups-0:2.4.19-4.6.hum1@aarch64",
"product": {
"name": "cups-0:2.4.19-4.6.hum1@aarch64",
"product_id": "cups-0:2.4.19-4.6.hum1@aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cups@2.4.19-4.6.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
},
{
"category": "product_version",
"name": "cups-client-0:2.4.19-4.6.hum1@aarch64",
"product": {
"name": "cups-client-0:2.4.19-4.6.hum1@aarch64",
"product_id": "cups-client-0:2.4.19-4.6.hum1@aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cups-client@2.4.19-4.6.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
},
{
"category": "product_version",
"name": "cups-devel-0:2.4.19-4.6.hum1@aarch64",
"product": {
"name": "cups-devel-0:2.4.19-4.6.hum1@aarch64",
"product_id": "cups-devel-0:2.4.19-4.6.hum1@aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cups-devel@2.4.19-4.6.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
},
{
"category": "product_version",
"name": "cups-ipptool-0:2.4.19-4.6.hum1@aarch64",
"product": {
"name": "cups-ipptool-0:2.4.19-4.6.hum1@aarch64",
"product_id": "cups-ipptool-0:2.4.19-4.6.hum1@aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cups-ipptool@2.4.19-4.6.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
},
{
"category": "product_version",
"name": "cups-libs-0:2.4.19-4.6.hum1@aarch64",
"product": {
"name": "cups-libs-0:2.4.19-4.6.hum1@aarch64",
"product_id": "cups-libs-0:2.4.19-4.6.hum1@aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cups-libs@2.4.19-4.6.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
},
{
"category": "product_version",
"name": "cups-lpd-0:2.4.19-4.6.hum1@aarch64",
"product": {
"name": "cups-lpd-0:2.4.19-4.6.hum1@aarch64",
"product_id": "cups-lpd-0:2.4.19-4.6.hum1@aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cups-lpd@2.4.19-4.6.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
},
{
"category": "product_version",
"name": "cups-printerapp-0:2.4.19-4.6.hum1@aarch64",
"product": {
"name": "cups-printerapp-0:2.4.19-4.6.hum1@aarch64",
"product_id": "cups-printerapp-0:2.4.19-4.6.hum1@aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cups-printerapp@2.4.19-4.6.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "cups-0:2.4.19-4.6.hum1@s390x",
"product": {
"name": "cups-0:2.4.19-4.6.hum1@s390x",
"product_id": "cups-0:2.4.19-4.6.hum1@s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cups@2.4.19-4.6.hum1?arch=s390x\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-s390x-rpms"
}
}
},
{
"category": "product_version",
"name": "cups-client-0:2.4.19-4.6.hum1@s390x",
"product": {
"name": "cups-client-0:2.4.19-4.6.hum1@s390x",
"product_id": "cups-client-0:2.4.19-4.6.hum1@s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cups-client@2.4.19-4.6.hum1?arch=s390x\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-s390x-rpms"
}
}
},
{
"category": "product_version",
"name": "cups-devel-0:2.4.19-4.6.hum1@s390x",
"product": {
"name": "cups-devel-0:2.4.19-4.6.hum1@s390x",
"product_id": "cups-devel-0:2.4.19-4.6.hum1@s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cups-devel@2.4.19-4.6.hum1?arch=s390x\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-s390x-rpms"
}
}
},
{
"category": "product_version",
"name": "cups-ipptool-0:2.4.19-4.6.hum1@s390x",
"product": {
"name": "cups-ipptool-0:2.4.19-4.6.hum1@s390x",
"product_id": "cups-ipptool-0:2.4.19-4.6.hum1@s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cups-ipptool@2.4.19-4.6.hum1?arch=s390x\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-s390x-rpms"
}
}
},
{
"category": "product_version",
"name": "cups-libs-0:2.4.19-4.6.hum1@s390x",
"product": {
"name": "cups-libs-0:2.4.19-4.6.hum1@s390x",
"product_id": "cups-libs-0:2.4.19-4.6.hum1@s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cups-libs@2.4.19-4.6.hum1?arch=s390x\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-s390x-rpms"
}
}
},
{
"category": "product_version",
"name": "cups-lpd-0:2.4.19-4.6.hum1@s390x",
"product": {
"name": "cups-lpd-0:2.4.19-4.6.hum1@s390x",
"product_id": "cups-lpd-0:2.4.19-4.6.hum1@s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cups-lpd@2.4.19-4.6.hum1?arch=s390x\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-s390x-rpms"
}
}
},
{
"category": "product_version",
"name": "cups-printerapp-0:2.4.19-4.6.hum1@s390x",
"product": {
"name": "cups-printerapp-0:2.4.19-4.6.hum1@s390x",
"product_id": "cups-printerapp-0:2.4.19-4.6.hum1@s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cups-printerapp@2.4.19-4.6.hum1?arch=s390x\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-s390x-rpms"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "cups-0:2.4.19-4.6.hum1@src",
"product": {
"name": "cups-0:2.4.19-4.6.hum1@src",
"product_id": "cups-0:2.4.19-4.6.hum1@src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cups@2.4.19-4.6.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "cups-0:2.4.19-4.6.hum1@x86_64",
"product": {
"name": "cups-0:2.4.19-4.6.hum1@x86_64",
"product_id": "cups-0:2.4.19-4.6.hum1@x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cups@2.4.19-4.6.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
},
{
"category": "product_version",
"name": "cups-client-0:2.4.19-4.6.hum1@x86_64",
"product": {
"name": "cups-client-0:2.4.19-4.6.hum1@x86_64",
"product_id": "cups-client-0:2.4.19-4.6.hum1@x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cups-client@2.4.19-4.6.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
},
{
"category": "product_version",
"name": "cups-devel-0:2.4.19-4.6.hum1@x86_64",
"product": {
"name": "cups-devel-0:2.4.19-4.6.hum1@x86_64",
"product_id": "cups-devel-0:2.4.19-4.6.hum1@x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cups-devel@2.4.19-4.6.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
},
{
"category": "product_version",
"name": "cups-ipptool-0:2.4.19-4.6.hum1@x86_64",
"product": {
"name": "cups-ipptool-0:2.4.19-4.6.hum1@x86_64",
"product_id": "cups-ipptool-0:2.4.19-4.6.hum1@x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cups-ipptool@2.4.19-4.6.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
},
{
"category": "product_version",
"name": "cups-libs-0:2.4.19-4.6.hum1@x86_64",
"product": {
"name": "cups-libs-0:2.4.19-4.6.hum1@x86_64",
"product_id": "cups-libs-0:2.4.19-4.6.hum1@x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cups-libs@2.4.19-4.6.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
},
{
"category": "product_version",
"name": "cups-lpd-0:2.4.19-4.6.hum1@x86_64",
"product": {
"name": "cups-lpd-0:2.4.19-4.6.hum1@x86_64",
"product_id": "cups-lpd-0:2.4.19-4.6.hum1@x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cups-lpd@2.4.19-4.6.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
},
{
"category": "product_version",
"name": "cups-printerapp-0:2.4.19-4.6.hum1@x86_64",
"product": {
"name": "cups-printerapp-0:2.4.19-4.6.hum1@x86_64",
"product_id": "cups-printerapp-0:2.4.19-4.6.hum1@x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cups-printerapp@2.4.19-4.6.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "cups-filesystem-0:2.4.19-4.6.hum1@noarch@public-hummingbird-aarch64-rpms",
"product": {
"name": "cups-filesystem-0:2.4.19-4.6.hum1@noarch@public-hummingbird-aarch64-rpms",
"product_id": "cups-filesystem-0:2.4.19-4.6.hum1@noarch@public-hummingbird-aarch64-rpms",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cups-filesystem@2.4.19-4.6.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
},
{
"category": "product_version",
"name": "cups-filesystem-0:2.4.19-4.6.hum1@noarch@public-hummingbird-s390x-rpms",
"product": {
"name": "cups-filesystem-0:2.4.19-4.6.hum1@noarch@public-hummingbird-s390x-rpms",
"product_id": "cups-filesystem-0:2.4.19-4.6.hum1@noarch@public-hummingbird-s390x-rpms",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cups-filesystem@2.4.19-4.6.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-s390x-rpms"
}
}
},
{
"category": "product_version",
"name": "cups-filesystem-0:2.4.19-4.6.hum1@noarch@public-hummingbird-x86_64-rpms",
"product": {
"name": "cups-filesystem-0:2.4.19-4.6.hum1@noarch@public-hummingbird-x86_64-rpms",
"product_id": "cups-filesystem-0:2.4.19-4.6.hum1@noarch@public-hummingbird-x86_64-rpms",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cups-filesystem@2.4.19-4.6.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "cups-0:2.4.19-4.6.hum1@aarch64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:cups-0:2.4.19-4.6.hum1@aarch64"
},
"product_reference": "cups-0:2.4.19-4.6.hum1@aarch64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cups-0:2.4.19-4.6.hum1@s390x as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:cups-0:2.4.19-4.6.hum1@s390x"
},
"product_reference": "cups-0:2.4.19-4.6.hum1@s390x",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cups-0:2.4.19-4.6.hum1@src as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:cups-0:2.4.19-4.6.hum1@src"
},
"product_reference": "cups-0:2.4.19-4.6.hum1@src",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cups-0:2.4.19-4.6.hum1@x86_64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:cups-0:2.4.19-4.6.hum1@x86_64"
},
"product_reference": "cups-0:2.4.19-4.6.hum1@x86_64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cups-client-0:2.4.19-4.6.hum1@aarch64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:cups-client-0:2.4.19-4.6.hum1@aarch64"
},
"product_reference": "cups-client-0:2.4.19-4.6.hum1@aarch64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cups-client-0:2.4.19-4.6.hum1@s390x as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:cups-client-0:2.4.19-4.6.hum1@s390x"
},
"product_reference": "cups-client-0:2.4.19-4.6.hum1@s390x",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cups-client-0:2.4.19-4.6.hum1@x86_64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:cups-client-0:2.4.19-4.6.hum1@x86_64"
},
"product_reference": "cups-client-0:2.4.19-4.6.hum1@x86_64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cups-devel-0:2.4.19-4.6.hum1@aarch64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:cups-devel-0:2.4.19-4.6.hum1@aarch64"
},
"product_reference": "cups-devel-0:2.4.19-4.6.hum1@aarch64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cups-devel-0:2.4.19-4.6.hum1@s390x as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:cups-devel-0:2.4.19-4.6.hum1@s390x"
},
"product_reference": "cups-devel-0:2.4.19-4.6.hum1@s390x",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cups-devel-0:2.4.19-4.6.hum1@x86_64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:cups-devel-0:2.4.19-4.6.hum1@x86_64"
},
"product_reference": "cups-devel-0:2.4.19-4.6.hum1@x86_64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cups-filesystem-0:2.4.19-4.6.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:cups-filesystem-0:2.4.19-4.6.hum1@noarch@public-hummingbird-aarch64-rpms"
},
"product_reference": "cups-filesystem-0:2.4.19-4.6.hum1@noarch@public-hummingbird-aarch64-rpms",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cups-filesystem-0:2.4.19-4.6.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:cups-filesystem-0:2.4.19-4.6.hum1@noarch@public-hummingbird-s390x-rpms"
},
"product_reference": "cups-filesystem-0:2.4.19-4.6.hum1@noarch@public-hummingbird-s390x-rpms",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cups-filesystem-0:2.4.19-4.6.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:cups-filesystem-0:2.4.19-4.6.hum1@noarch@public-hummingbird-x86_64-rpms"
},
"product_reference": "cups-filesystem-0:2.4.19-4.6.hum1@noarch@public-hummingbird-x86_64-rpms",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cups-ipptool-0:2.4.19-4.6.hum1@aarch64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:cups-ipptool-0:2.4.19-4.6.hum1@aarch64"
},
"product_reference": "cups-ipptool-0:2.4.19-4.6.hum1@aarch64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cups-ipptool-0:2.4.19-4.6.hum1@s390x as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:cups-ipptool-0:2.4.19-4.6.hum1@s390x"
},
"product_reference": "cups-ipptool-0:2.4.19-4.6.hum1@s390x",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cups-ipptool-0:2.4.19-4.6.hum1@x86_64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:cups-ipptool-0:2.4.19-4.6.hum1@x86_64"
},
"product_reference": "cups-ipptool-0:2.4.19-4.6.hum1@x86_64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cups-libs-0:2.4.19-4.6.hum1@aarch64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:cups-libs-0:2.4.19-4.6.hum1@aarch64"
},
"product_reference": "cups-libs-0:2.4.19-4.6.hum1@aarch64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cups-libs-0:2.4.19-4.6.hum1@s390x as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:cups-libs-0:2.4.19-4.6.hum1@s390x"
},
"product_reference": "cups-libs-0:2.4.19-4.6.hum1@s390x",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cups-libs-0:2.4.19-4.6.hum1@x86_64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:cups-libs-0:2.4.19-4.6.hum1@x86_64"
},
"product_reference": "cups-libs-0:2.4.19-4.6.hum1@x86_64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cups-lpd-0:2.4.19-4.6.hum1@aarch64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:cups-lpd-0:2.4.19-4.6.hum1@aarch64"
},
"product_reference": "cups-lpd-0:2.4.19-4.6.hum1@aarch64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cups-lpd-0:2.4.19-4.6.hum1@s390x as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:cups-lpd-0:2.4.19-4.6.hum1@s390x"
},
"product_reference": "cups-lpd-0:2.4.19-4.6.hum1@s390x",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cups-lpd-0:2.4.19-4.6.hum1@x86_64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:cups-lpd-0:2.4.19-4.6.hum1@x86_64"
},
"product_reference": "cups-lpd-0:2.4.19-4.6.hum1@x86_64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cups-printerapp-0:2.4.19-4.6.hum1@aarch64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:cups-printerapp-0:2.4.19-4.6.hum1@aarch64"
},
"product_reference": "cups-printerapp-0:2.4.19-4.6.hum1@aarch64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cups-printerapp-0:2.4.19-4.6.hum1@s390x as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:cups-printerapp-0:2.4.19-4.6.hum1@s390x"
},
"product_reference": "cups-printerapp-0:2.4.19-4.6.hum1@s390x",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cups-printerapp-0:2.4.19-4.6.hum1@x86_64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:cups-printerapp-0:2.4.19-4.6.hum1@x86_64"
},
"product_reference": "cups-printerapp-0:2.4.19-4.6.hum1@x86_64",
"relates_to_product_reference": "Red Hat Hardened Images"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-55453",
"cwe": {
"id": "CWE-93",
"name": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)"
},
"discovery_date": "2026-10-15T17:24:29.648030+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2553616"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in CUPS. A remote attacker controlling a network printer can achieve arbitrary code execution by returning crafted printer status messages containing newline characters. The CUPS Internet Printing Protocol (IPP) backend fails to sanitize line breaks in status attributes, allowing injected control directives to be processed by the printing scheduler. These injected directives modify local printer configuration files, causing subsequent print jobs to execute arbitrary commands with the privileges of the print service account.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "cups: cups: Arbitrary code execution via newline injection in printer status messages",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as an Important severity security flaw because an untrusted network printer can trigger command execution with the privileges of the print service account (lp). Exploitation requires configuring a queue against a rogue IPP printer and using a legacy Foomatic-based driver filter. While systems operating in headless environments or using modern driverless printing workflows are unaffected, environments that configure arbitrary network printers face significant integrity and confidentiality risks without requiring prior local authentication.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:cups-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-0:2.4.19-4.6.hum1@src",
"Red Hat Hardened Images:cups-0:2.4.19-4.6.hum1@x86_64",
"Red Hat Hardened Images:cups-client-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-client-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-client-0:2.4.19-4.6.hum1@x86_64",
"Red Hat Hardened Images:cups-devel-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-devel-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-devel-0:2.4.19-4.6.hum1@x86_64",
"Red Hat Hardened Images:cups-filesystem-0:2.4.19-4.6.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:cups-filesystem-0:2.4.19-4.6.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:cups-filesystem-0:2.4.19-4.6.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:cups-ipptool-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-ipptool-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-ipptool-0:2.4.19-4.6.hum1@x86_64",
"Red Hat Hardened Images:cups-libs-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-libs-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-libs-0:2.4.19-4.6.hum1@x86_64",
"Red Hat Hardened Images:cups-lpd-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-lpd-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-lpd-0:2.4.19-4.6.hum1@x86_64",
"Red Hat Hardened Images:cups-printerapp-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-printerapp-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-printerapp-0:2.4.19-4.6.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-55453"
},
{
"category": "external",
"summary": "RHBZ#2553616",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553616"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-55453",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-55453"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55453",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55453"
},
{
"category": "external",
"summary": "https://github.com/OpenPrinting/cups/commit/806e1b483096c51d59432468f4afdd7387d81dd7",
"url": "https://github.com/OpenPrinting/cups/commit/806e1b483096c51d59432468f4afdd7387d81dd7"
},
{
"category": "external",
"summary": "https://github.com/OpenPrinting/cups/commit/d41cf0616688721e9d435d54118c4c8a36ed596a",
"url": "https://github.com/OpenPrinting/cups/commit/d41cf0616688721e9d435d54118c4c8a36ed596a"
},
{
"category": "external",
"summary": "https://github.com/OpenPrinting/cups/releases/tag/v2.4.20",
"url": "https://github.com/OpenPrinting/cups/releases/tag/v2.4.20"
},
{
"category": "external",
"summary": "https://github.com/OpenPrinting/cups/security/advisories/GHSA-7hqf-mfhx-7r3v",
"url": "https://github.com/OpenPrinting/cups/security/advisories/GHSA-7hqf-mfhx-7r3v"
}
],
"release_date": "2026-10-15T17:11:21.208000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-17T17:48:21+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:cups-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-0:2.4.19-4.6.hum1@src",
"Red Hat Hardened Images:cups-0:2.4.19-4.6.hum1@x86_64",
"Red Hat Hardened Images:cups-client-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-client-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-client-0:2.4.19-4.6.hum1@x86_64",
"Red Hat Hardened Images:cups-devel-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-devel-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-devel-0:2.4.19-4.6.hum1@x86_64",
"Red Hat Hardened Images:cups-filesystem-0:2.4.19-4.6.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:cups-filesystem-0:2.4.19-4.6.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:cups-filesystem-0:2.4.19-4.6.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:cups-ipptool-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-ipptool-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-ipptool-0:2.4.19-4.6.hum1@x86_64",
"Red Hat Hardened Images:cups-libs-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-libs-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-libs-0:2.4.19-4.6.hum1@x86_64",
"Red Hat Hardened Images:cups-lpd-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-lpd-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-lpd-0:2.4.19-4.6.hum1@x86_64",
"Red Hat Hardened Images:cups-printerapp-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-printerapp-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-printerapp-0:2.4.19-4.6.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:84421"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:cups-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-0:2.4.19-4.6.hum1@src",
"Red Hat Hardened Images:cups-0:2.4.19-4.6.hum1@x86_64",
"Red Hat Hardened Images:cups-client-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-client-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-client-0:2.4.19-4.6.hum1@x86_64",
"Red Hat Hardened Images:cups-devel-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-devel-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-devel-0:2.4.19-4.6.hum1@x86_64",
"Red Hat Hardened Images:cups-filesystem-0:2.4.19-4.6.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:cups-filesystem-0:2.4.19-4.6.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:cups-filesystem-0:2.4.19-4.6.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:cups-ipptool-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-ipptool-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-ipptool-0:2.4.19-4.6.hum1@x86_64",
"Red Hat Hardened Images:cups-libs-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-libs-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-libs-0:2.4.19-4.6.hum1@x86_64",
"Red Hat Hardened Images:cups-lpd-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-lpd-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-lpd-0:2.4.19-4.6.hum1@x86_64",
"Red Hat Hardened Images:cups-printerapp-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-printerapp-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-printerapp-0:2.4.19-4.6.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "cups: cups: Arbitrary code execution via newline injection in printer status messages"
},
{
"cve": "CVE-2026-55467",
"cwe": {
"id": "CWE-88",
"name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
},
"discovery_date": "2026-10-15T17:25:01.463652+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2553617"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in CUPS. This vulnerability allows an authorized user to cause a Denial of Service (DoS) by submitting print jobs containing specially crafted fax queue attributes. Because certain fax parameters bypass input sanitization when passed to downstream processing filters, an attacker can inject control characters into the filter option stream. This can disrupt the operation of the affected print queue or trigger unintended behavior in downstream filters.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "cups: cups: Denial of Service via unsanitized fax job attributes",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw is rated with a Low severity because exploitation requires a specialized FAX queue to be configured, which is not present in default Red Hat Enterprise Linux installations. Furthermore, an attacker must already possess local authorization to submit print jobs to that specific queue, and the issue only results in potential disruption of the affected queue without impacting system confidentiality or integrity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:cups-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-0:2.4.19-4.6.hum1@src",
"Red Hat Hardened Images:cups-0:2.4.19-4.6.hum1@x86_64",
"Red Hat Hardened Images:cups-client-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-client-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-client-0:2.4.19-4.6.hum1@x86_64",
"Red Hat Hardened Images:cups-devel-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-devel-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-devel-0:2.4.19-4.6.hum1@x86_64",
"Red Hat Hardened Images:cups-filesystem-0:2.4.19-4.6.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:cups-filesystem-0:2.4.19-4.6.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:cups-filesystem-0:2.4.19-4.6.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:cups-ipptool-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-ipptool-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-ipptool-0:2.4.19-4.6.hum1@x86_64",
"Red Hat Hardened Images:cups-libs-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-libs-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-libs-0:2.4.19-4.6.hum1@x86_64",
"Red Hat Hardened Images:cups-lpd-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-lpd-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-lpd-0:2.4.19-4.6.hum1@x86_64",
"Red Hat Hardened Images:cups-printerapp-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-printerapp-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-printerapp-0:2.4.19-4.6.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-55467"
},
{
"category": "external",
"summary": "RHBZ#2553617",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553617"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-55467",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-55467"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55467",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55467"
},
{
"category": "external",
"summary": "https://github.com/OpenPrinting/cups/commit/0cf4e7814d6810ed3c454222bce3aa342d541681",
"url": "https://github.com/OpenPrinting/cups/commit/0cf4e7814d6810ed3c454222bce3aa342d541681"
},
{
"category": "external",
"summary": "https://github.com/OpenPrinting/cups/commit/a9e7e7a3a019d0fa063d29409d3f82e4c6d5a008",
"url": "https://github.com/OpenPrinting/cups/commit/a9e7e7a3a019d0fa063d29409d3f82e4c6d5a008"
},
{
"category": "external",
"summary": "https://github.com/OpenPrinting/cups/releases/tag/v2.4.20",
"url": "https://github.com/OpenPrinting/cups/releases/tag/v2.4.20"
},
{
"category": "external",
"summary": "https://github.com/OpenPrinting/cups/security/advisories/GHSA-69qc-prxg-h2c7",
"url": "https://github.com/OpenPrinting/cups/security/advisories/GHSA-69qc-prxg-h2c7"
}
],
"release_date": "2026-10-15T17:08:24.374000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-17T17:48:21+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:cups-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-0:2.4.19-4.6.hum1@src",
"Red Hat Hardened Images:cups-0:2.4.19-4.6.hum1@x86_64",
"Red Hat Hardened Images:cups-client-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-client-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-client-0:2.4.19-4.6.hum1@x86_64",
"Red Hat Hardened Images:cups-devel-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-devel-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-devel-0:2.4.19-4.6.hum1@x86_64",
"Red Hat Hardened Images:cups-filesystem-0:2.4.19-4.6.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:cups-filesystem-0:2.4.19-4.6.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:cups-filesystem-0:2.4.19-4.6.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:cups-ipptool-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-ipptool-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-ipptool-0:2.4.19-4.6.hum1@x86_64",
"Red Hat Hardened Images:cups-libs-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-libs-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-libs-0:2.4.19-4.6.hum1@x86_64",
"Red Hat Hardened Images:cups-lpd-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-lpd-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-lpd-0:2.4.19-4.6.hum1@x86_64",
"Red Hat Hardened Images:cups-printerapp-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-printerapp-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-printerapp-0:2.4.19-4.6.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:84421"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 2.5,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:cups-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-0:2.4.19-4.6.hum1@src",
"Red Hat Hardened Images:cups-0:2.4.19-4.6.hum1@x86_64",
"Red Hat Hardened Images:cups-client-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-client-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-client-0:2.4.19-4.6.hum1@x86_64",
"Red Hat Hardened Images:cups-devel-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-devel-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-devel-0:2.4.19-4.6.hum1@x86_64",
"Red Hat Hardened Images:cups-filesystem-0:2.4.19-4.6.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:cups-filesystem-0:2.4.19-4.6.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:cups-filesystem-0:2.4.19-4.6.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:cups-ipptool-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-ipptool-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-ipptool-0:2.4.19-4.6.hum1@x86_64",
"Red Hat Hardened Images:cups-libs-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-libs-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-libs-0:2.4.19-4.6.hum1@x86_64",
"Red Hat Hardened Images:cups-lpd-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-lpd-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-lpd-0:2.4.19-4.6.hum1@x86_64",
"Red Hat Hardened Images:cups-printerapp-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-printerapp-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-printerapp-0:2.4.19-4.6.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "cups: cups: Denial of Service via unsanitized fax job attributes"
},
{
"cve": "CVE-2026-55480",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-10-15T17:23:01.062177+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2553613"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in CUPS. Insecure temporary file handling allows a local attacker with print administrative privileges to overwrite arbitrary system files. When configuring a printer, the print service creates a temporary file with a predictable name in a shared directory without verifying whether the file is a symbolic link (symlink). By creating a symlink targeting a sensitive file before the service opens it, an attacker can cause the privileged service to truncate or overwrite that file, leading to data corruption, service disruption, or privilege escalation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "cups: cups: Arbitrary file overwrite via insecure temporary file handling",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Moderate impact for Red Hat environments because successful exploitation requires local access, specific group privileges, and synchronization with a privileged administration task. In default Red Hat Enterprise Linux deployments, CUPS print services typically execute with restricted group permissions, meaning an attacker must already control a process within the lp group. Additionally, the flaw can only be triggered while an authorized administrator creates or modifies a printer queue using a model PPD, limiting the exposure window. Although arbitrary file modification by the root scheduler could lead to privilege escalation, these strict operational prerequisites prevent remote or unprivileged exploitation.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:cups-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-0:2.4.19-4.6.hum1@src",
"Red Hat Hardened Images:cups-0:2.4.19-4.6.hum1@x86_64",
"Red Hat Hardened Images:cups-client-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-client-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-client-0:2.4.19-4.6.hum1@x86_64",
"Red Hat Hardened Images:cups-devel-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-devel-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-devel-0:2.4.19-4.6.hum1@x86_64",
"Red Hat Hardened Images:cups-filesystem-0:2.4.19-4.6.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:cups-filesystem-0:2.4.19-4.6.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:cups-filesystem-0:2.4.19-4.6.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:cups-ipptool-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-ipptool-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-ipptool-0:2.4.19-4.6.hum1@x86_64",
"Red Hat Hardened Images:cups-libs-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-libs-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-libs-0:2.4.19-4.6.hum1@x86_64",
"Red Hat Hardened Images:cups-lpd-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-lpd-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-lpd-0:2.4.19-4.6.hum1@x86_64",
"Red Hat Hardened Images:cups-printerapp-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-printerapp-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-printerapp-0:2.4.19-4.6.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-55480"
},
{
"category": "external",
"summary": "RHBZ#2553613",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553613"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-55480",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-55480"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55480",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55480"
},
{
"category": "external",
"summary": "https://github.com/OpenPrinting/cups/commit/98adfd855950e806508f961d5438ad32e26aac62",
"url": "https://github.com/OpenPrinting/cups/commit/98adfd855950e806508f961d5438ad32e26aac62"
},
{
"category": "external",
"summary": "https://github.com/OpenPrinting/cups/commit/f6a11dae0f0f3b748fbca931e237be03ffe8e48e",
"url": "https://github.com/OpenPrinting/cups/commit/f6a11dae0f0f3b748fbca931e237be03ffe8e48e"
},
{
"category": "external",
"summary": "https://github.com/OpenPrinting/cups/releases/tag/v2.4.20",
"url": "https://github.com/OpenPrinting/cups/releases/tag/v2.4.20"
},
{
"category": "external",
"summary": "https://github.com/OpenPrinting/cups/security/advisories/GHSA-jj94-x3qh-ffp9",
"url": "https://github.com/OpenPrinting/cups/security/advisories/GHSA-jj94-x3qh-ffp9"
}
],
"release_date": "2026-10-15T17:09:33.878000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-17T17:48:21+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:cups-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-0:2.4.19-4.6.hum1@src",
"Red Hat Hardened Images:cups-0:2.4.19-4.6.hum1@x86_64",
"Red Hat Hardened Images:cups-client-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-client-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-client-0:2.4.19-4.6.hum1@x86_64",
"Red Hat Hardened Images:cups-devel-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-devel-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-devel-0:2.4.19-4.6.hum1@x86_64",
"Red Hat Hardened Images:cups-filesystem-0:2.4.19-4.6.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:cups-filesystem-0:2.4.19-4.6.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:cups-filesystem-0:2.4.19-4.6.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:cups-ipptool-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-ipptool-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-ipptool-0:2.4.19-4.6.hum1@x86_64",
"Red Hat Hardened Images:cups-libs-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-libs-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-libs-0:2.4.19-4.6.hum1@x86_64",
"Red Hat Hardened Images:cups-lpd-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-lpd-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-lpd-0:2.4.19-4.6.hum1@x86_64",
"Red Hat Hardened Images:cups-printerapp-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-printerapp-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-printerapp-0:2.4.19-4.6.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:84421"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:cups-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-0:2.4.19-4.6.hum1@src",
"Red Hat Hardened Images:cups-0:2.4.19-4.6.hum1@x86_64",
"Red Hat Hardened Images:cups-client-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-client-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-client-0:2.4.19-4.6.hum1@x86_64",
"Red Hat Hardened Images:cups-devel-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-devel-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-devel-0:2.4.19-4.6.hum1@x86_64",
"Red Hat Hardened Images:cups-filesystem-0:2.4.19-4.6.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:cups-filesystem-0:2.4.19-4.6.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:cups-filesystem-0:2.4.19-4.6.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:cups-ipptool-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-ipptool-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-ipptool-0:2.4.19-4.6.hum1@x86_64",
"Red Hat Hardened Images:cups-libs-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-libs-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-libs-0:2.4.19-4.6.hum1@x86_64",
"Red Hat Hardened Images:cups-lpd-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-lpd-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-lpd-0:2.4.19-4.6.hum1@x86_64",
"Red Hat Hardened Images:cups-printerapp-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-printerapp-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-printerapp-0:2.4.19-4.6.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "cups: cups: Arbitrary file overwrite via insecure temporary file handling"
},
{
"cve": "CVE-2026-61702",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-10-15T17:21:43.137236+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2553611"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in CUPS. An information disclosure vulnerability allows an attacker to read files on the system by submitting a specially crafted print job containing directory traversal characters in the language attribute. Because the scheduler fails to validate path separators when processing banner pages, it can open files accessible to the root process and copy their contents into print spool objects delivered to an attacker-controlled destination.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "cups: cups: Information disclosure via path traversal in banner processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Moderate severity because, although an unauthenticated network attacker could submit a crafted print request, successful file disclosure requires stringent preconditions such as existing files matching registered banner names along the traversed path. In typical Red Hat Enterprise Linux deployments, CUPS is bound solely to the local loopback interface by default, preventing direct remote exploitation from external networks. Additionally, default SELinux policies enforce boundary restrictions on the printing daemon, significantly mitigating the blast radius and preventing access to arbitrary system files.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:cups-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-0:2.4.19-4.6.hum1@src",
"Red Hat Hardened Images:cups-0:2.4.19-4.6.hum1@x86_64",
"Red Hat Hardened Images:cups-client-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-client-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-client-0:2.4.19-4.6.hum1@x86_64",
"Red Hat Hardened Images:cups-devel-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-devel-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-devel-0:2.4.19-4.6.hum1@x86_64",
"Red Hat Hardened Images:cups-filesystem-0:2.4.19-4.6.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:cups-filesystem-0:2.4.19-4.6.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:cups-filesystem-0:2.4.19-4.6.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:cups-ipptool-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-ipptool-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-ipptool-0:2.4.19-4.6.hum1@x86_64",
"Red Hat Hardened Images:cups-libs-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-libs-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-libs-0:2.4.19-4.6.hum1@x86_64",
"Red Hat Hardened Images:cups-lpd-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-lpd-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-lpd-0:2.4.19-4.6.hum1@x86_64",
"Red Hat Hardened Images:cups-printerapp-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-printerapp-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-printerapp-0:2.4.19-4.6.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-61702"
},
{
"category": "external",
"summary": "RHBZ#2553611",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553611"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-61702",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-61702"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-61702",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61702"
},
{
"category": "external",
"summary": "https://github.com/OpenPrinting/cups/commit/08a8a277ce2a8948a1af33552247a1ac53b72df3",
"url": "https://github.com/OpenPrinting/cups/commit/08a8a277ce2a8948a1af33552247a1ac53b72df3"
},
{
"category": "external",
"summary": "https://github.com/OpenPrinting/cups/commit/6650428234616a97d3298e0e2d4419c62c1339d2",
"url": "https://github.com/OpenPrinting/cups/commit/6650428234616a97d3298e0e2d4419c62c1339d2"
},
{
"category": "external",
"summary": "https://github.com/OpenPrinting/cups/releases/tag/v2.4.20",
"url": "https://github.com/OpenPrinting/cups/releases/tag/v2.4.20"
},
{
"category": "external",
"summary": "https://github.com/OpenPrinting/cups/security/advisories/GHSA-gq9p-4w7m-2f5g",
"url": "https://github.com/OpenPrinting/cups/security/advisories/GHSA-gq9p-4w7m-2f5g"
}
],
"release_date": "2026-10-15T17:12:10.695000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-17T17:48:21+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:cups-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-0:2.4.19-4.6.hum1@src",
"Red Hat Hardened Images:cups-0:2.4.19-4.6.hum1@x86_64",
"Red Hat Hardened Images:cups-client-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-client-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-client-0:2.4.19-4.6.hum1@x86_64",
"Red Hat Hardened Images:cups-devel-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-devel-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-devel-0:2.4.19-4.6.hum1@x86_64",
"Red Hat Hardened Images:cups-filesystem-0:2.4.19-4.6.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:cups-filesystem-0:2.4.19-4.6.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:cups-filesystem-0:2.4.19-4.6.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:cups-ipptool-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-ipptool-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-ipptool-0:2.4.19-4.6.hum1@x86_64",
"Red Hat Hardened Images:cups-libs-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-libs-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-libs-0:2.4.19-4.6.hum1@x86_64",
"Red Hat Hardened Images:cups-lpd-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-lpd-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-lpd-0:2.4.19-4.6.hum1@x86_64",
"Red Hat Hardened Images:cups-printerapp-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-printerapp-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-printerapp-0:2.4.19-4.6.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:84421"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:cups-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-0:2.4.19-4.6.hum1@src",
"Red Hat Hardened Images:cups-0:2.4.19-4.6.hum1@x86_64",
"Red Hat Hardened Images:cups-client-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-client-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-client-0:2.4.19-4.6.hum1@x86_64",
"Red Hat Hardened Images:cups-devel-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-devel-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-devel-0:2.4.19-4.6.hum1@x86_64",
"Red Hat Hardened Images:cups-filesystem-0:2.4.19-4.6.hum1@noarch@public-hummingbird-aarch64-rpms",
"Red Hat Hardened Images:cups-filesystem-0:2.4.19-4.6.hum1@noarch@public-hummingbird-s390x-rpms",
"Red Hat Hardened Images:cups-filesystem-0:2.4.19-4.6.hum1@noarch@public-hummingbird-x86_64-rpms",
"Red Hat Hardened Images:cups-ipptool-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-ipptool-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-ipptool-0:2.4.19-4.6.hum1@x86_64",
"Red Hat Hardened Images:cups-libs-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-libs-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-libs-0:2.4.19-4.6.hum1@x86_64",
"Red Hat Hardened Images:cups-lpd-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-lpd-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-lpd-0:2.4.19-4.6.hum1@x86_64",
"Red Hat Hardened Images:cups-printerapp-0:2.4.19-4.6.hum1@aarch64",
"Red Hat Hardened Images:cups-printerapp-0:2.4.19-4.6.hum1@s390x",
"Red Hat Hardened Images:cups-printerapp-0:2.4.19-4.6.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "cups: cups: Information disclosure via path traversal in banner processing"
}
]
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.