Critical Security Update for CUPS: Addressing Remote DoS and Authentication Bypass Vulnerabilities
Summary
ALSA-2025:15701: Important: cups security update. Affects cups versions < 1:2.4.10-11.el10_0.1. Fixed in 1:2.4.10-11.el10_0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Common UNIX Printing System (CUPS) is an essential printing layer for Linux, UNIX, and similar operating systems, enabling users to manage print jobs and printers. CUPS supports various printing protocols and provides a user-friendly interface for printer management. However, it has recently been found vulnerable to critical security issues that could lead to service disruptions and unauthorized access.
Vulnerability Detail
The vulnerabilities identified in CUPS include a Null Pointer Dereference in the ipp_read_io() function, which can lead to a remote Denial of Service (DoS) attack (CVE-2025-58364). Additionally, an Authentication Bypass issue in CUPS Authorization Handling (CVE-2025-58060) allows unauthorized users to gain access to restricted functionalities. These vulnerabilities can severely impact the availability and security of printing services, making it crucial for users to address them promptly.
How To Fix
Minimum fixed version
1:2.4.10-11.el10_0.1
This is the first release that contains the fix.
sudo dnf update cupsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the CUPS web interface by modifying the configuration file located at /etc/cups/cupsd.conf. Set the 'Allow' directives to limit access to trusted IP addresses only. For example: 'Allow from 192.168.1.*' to restrict access to a specific subnet.
Conclusion
The vulnerabilities in CUPS present significant risks that can lead to service disruptions and unauthorized access. It is essential for users to update their installations to the latest patched version and consider implementing temporary workarounds to mitigate risks until the update can be applied.
See every vulnerability recorded for cups →
FAQ
CUPS stands for Common UNIX Printing System, which is a modular printing system for Unix-like operating systems that allows a computer to act as a print server.
The vulnerabilities could lead to service disruptions through remote DoS attacks and unauthorized access to printer management functionalities.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
Yes, you can temporarily restrict access to the CUPS web interface by modifying the cupsd.conf configuration file to limit access to trusted IP addresses.
More details can be found on the CVE pages for CVE-2025-58060 and CVE-2025-58364, which provide insights into the vulnerabilities and their impacts.
Related vulnerabilities
Recent vulnerabilities recorded for cups.
