Critical Security Update for ipp-usb: Addressing Multiple Denial of Service Vulnerabilities
Summary
ALSA-2026:62631: Important: golang-github-openprinting-ipp-usb security update. Affects ipp-usb versions < 0.9.27-7.el10_2.3. Fixed in 0.9.27-7.el10_2.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The ipp-usb package is an essential component that facilitates driverless support for USB devices using the IPP-over-USB protocol. This package acts as an HTTP reverse proxy, connecting USB devices to applications seamlessly. However, it has been found to be vulnerable to several Denial of Service (DoS) attacks, which could severely impact its functionality and the services relying on it.
Vulnerability Detail
The vulnerabilities stem from various components within the Go programming language used in the ipp-usb package. Notable issues include a Denial of Service via maliciously-crafted MIME headers, excessive recursion in ASN.1 unmarshalling, quadratic complexity in path resolution, and vulnerabilities in unencrypted HTTP/2 connections. These vulnerabilities can lead to service disruptions, making the system unresponsive or crashing it entirely.
How To Fix
Minimum fixed version
0.9.27-7.el10_2.3
This is the first release that contains the fix.
sudo dnf update ipp-usbTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider disabling the affected features of the ipp-usb package until the update can be applied. This may involve configuring the service to limit exposure to untrusted inputs or restricting access to the service.
Conclusion
The ipp-usb package has critical vulnerabilities that require immediate attention. By updating to the latest patched version, users can protect their systems from potential Denial of Service attacks. Additionally, utilizing tools like Vulert can help monitor for vulnerabilities in real-time.
See every vulnerability recorded for ipp-usb →
FAQ
The vulnerabilities can lead to Denial of Service attacks, causing the service to become unresponsive or crash, which can disrupt operations relying on USB devices.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
Yes, you can temporarily disable the affected features or restrict access to the ipp-usb service until the patch is applied.
The vulnerabilities are associated with several CVEs, including CVE-2026-33818, CVE-2026-42504, CVE-2026-56853, CVE-2026-56859, CVE-2026-56860, and CVE-2026-56862.
For detailed information about the security issues, including CVSS scores and acknowledgments, refer to the respective CVE pages linked in the vulnerability report.
Related vulnerabilities
Recent vulnerabilities recorded for ipp-usb.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
