CVE
CVE-2026-107885
- First Reported
- Oct 13, 2026
- Latest Reported
- Oct 13, 2026
CVE Enrichment
- CVSS
- 3.3 LOW
- EPSS
- 0.10%
- EPSS Percentile
- 0.68%
- CISA KEV
- Not listed
Description
OpenPrinting CUPS through 2.4.20 contains a resource-exhaustion vulnerability in the submission-timeout handling of cupsdCheckJobs(). The scheduler suppresses timeout processing for all pending jobs whenever any client connection has an in-flight Send-Document operation, without matching that connection to the job being examined. A client allowed to reach the IPP service can hold an incomplete HTTP request containing parsed Send-Document headers before operation authorization, preventing unrelated incomplete jobs from expiring. Where Create-Job submission is allowed, incomplete jobs can accumulate until MaxJobs is exhausted and further legitimate print submissions are rejected. The suppression ends when the held connection closes.
Technical Details
- CVSS Version
- 3.1
- CNA / NVD Source
- cve@mitre.org
- Published
- 09-Oct-2026 11:18
- Last Modified
- 10-Oct-2026 04:17
- EPSS Date
- 2026-10-14
- CWE
- CWE-770
CVSS Vector
CVSS:3.1 AV:L /
AC:L /
PR:L /
UI:N /
S:U /
C:N /
I:N /
A:L
References
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.
Reported Context (1)
CVE (1235)
People (2)
MITRE ATT&CK (1)
Vendors (14)
Products (87)
Tools (1)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.