UBUNTU-CVE-2026-107890

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2026-107890
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-107890.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-107890
Upstream
Published
2026-10-09T05:16:00Z
Modified
2026-10-17T12:58:01Z
Severity
  • 3.3 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
  • Ubuntu - medium
Summary
[none]
Details

OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation requests. IPP parsing creates unnamed separator attributes with IPP_TAG_ZERO, but add_job() converts these separators to IPP_TAG_JOB. During job startup, get_options()/ipp_length() subsequently calls strlen() on a NULL attribute name, terminating cupsd and disrupting all queues. A single crafted Print-Job request can trigger the crash when the client can reach the scheduler and submit jobs to an accepting, enabled queue supporting the submitted document format. Anonymous submission is possible when permitted by listener and access-control configuration.

References

Affected packages

Ubuntu:22.04:LTS
cups

Package

Name
cups
Purl
pkg:deb/ubuntu/cups?arch=source&distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.3.3op2-7ubuntu2
2.4.1op1-1ubuntu1
2.4.1op1-1ubuntu2
2.4.1op1-1ubuntu3
2.4.1op1-1ubuntu4
2.4.1op1-1ubuntu4.1
2.4.1op1-1ubuntu4.2
2.4.1op1-1ubuntu4.4
2.4.1op1-1ubuntu4.6
2.4.1op1-1ubuntu4.7
2.4.1op1-1ubuntu4.8
2.4.1op1-1ubuntu4.9
2.4.1op1-1ubuntu4.10
2.4.1op1-1ubuntu4.11
2.4.1op1-1ubuntu4.12
2.4.1op1-1ubuntu4.15
2.4.1op1-1ubuntu4.16
2.4.1op1-1ubuntu4.20
2.4.1op1-1ubuntu4.21

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "cups",
            "binary_version":  "2.4.1op1-1ubuntu4.21"
        },
        {
            "binary_name":  "cups-bsd",
            "binary_version":  "2.4.1op1-1ubuntu4.21"
        },
        {
            "binary_name":  "cups-client",
            "binary_version":  "2.4.1op1-1ubuntu4.21"
        },
        {
            "binary_name":  "cups-common",
            "binary_version":  "2.4.1op1-1ubuntu4.21"
        },
        {
            "binary_name":  "cups-core-drivers",
            "binary_version":  "2.4.1op1-1ubuntu4.21"
        },
        {
            "binary_name":  "cups-daemon",
            "binary_version":  "2.4.1op1-1ubuntu4.21"
        },
        {
            "binary_name":  "cups-ipp-utils",
            "binary_version":  "2.4.1op1-1ubuntu4.21"
        },
        {
            "binary_name":  "cups-ppdc",
            "binary_version":  "2.4.1op1-1ubuntu4.21"
        },
        {
            "binary_name":  "cups-server-common",
            "binary_version":  "2.4.1op1-1ubuntu4.21"
        },
        {
            "binary_name":  "libcups2",
            "binary_version":  "2.4.1op1-1ubuntu4.21"
        },
        {
            "binary_name":  "libcupsimage2",
            "binary_version":  "2.4.1op1-1ubuntu4.21"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-107890.json"
Ubuntu:24.04:LTS
cups

Package

Name
cups
Purl
pkg:deb/ubuntu/cups?arch=source&distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.4.6-0ubuntu3
2.4.7-1.2ubuntu2
2.4.7-1.2ubuntu3
2.4.7-1.2ubuntu7
2.4.7-1.2ubuntu7.1
2.4.7-1.2ubuntu7.2
2.4.7-1.2ubuntu7.3
2.4.7-1.2ubuntu7.4
2.4.7-1.2ubuntu7.7
2.4.7-1.2ubuntu7.9
2.4.7-1.2ubuntu7.13
2.4.7-1.2ubuntu7.14

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "cups",
            "binary_version":  "2.4.7-1.2ubuntu7.14"
        },
        {
            "binary_name":  "cups-bsd",
            "binary_version":  "2.4.7-1.2ubuntu7.14"
        },
        {
            "binary_name":  "cups-client",
            "binary_version":  "2.4.7-1.2ubuntu7.14"
        },
        {
            "binary_name":  "cups-common",
            "binary_version":  "2.4.7-1.2ubuntu7.14"
        },
        {
            "binary_name":  "cups-core-drivers",
            "binary_version":  "2.4.7-1.2ubuntu7.14"
        },
        {
            "binary_name":  "cups-daemon",
            "binary_version":  "2.4.7-1.2ubuntu7.14"
        },
        {
            "binary_name":  "cups-ipp-utils",
            "binary_version":  "2.4.7-1.2ubuntu7.14"
        },
        {
            "binary_name":  "cups-ppdc",
            "binary_version":  "2.4.7-1.2ubuntu7.14"
        },
        {
            "binary_name":  "cups-server-common",
            "binary_version":  "2.4.7-1.2ubuntu7.14"
        },
        {
            "binary_name":  "libcups2t64",
            "binary_version":  "2.4.7-1.2ubuntu7.14"
        },
        {
            "binary_name":  "libcupsimage2t64",
            "binary_version":  "2.4.7-1.2ubuntu7.14"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-107890.json"
Ubuntu:26.04:LTS
cups

Package

Name
cups
Purl
pkg:deb/ubuntu/cups?arch=source&distro=resolute

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.4.12-0ubuntu3
2.4.12-0ubuntu5
2.4.16-1ubuntu1
2.4.16-1ubuntu1.2
2.4.16-1ubuntu1.3

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "cups",
            "binary_version":  "2.4.16-1ubuntu1.3"
        },
        {
            "binary_name":  "cups-bsd",
            "binary_version":  "2.4.16-1ubuntu1.3"
        },
        {
            "binary_name":  "cups-client",
            "binary_version":  "2.4.16-1ubuntu1.3"
        },
        {
            "binary_name":  "cups-common",
            "binary_version":  "2.4.16-1ubuntu1.3"
        },
        {
            "binary_name":  "cups-core-drivers",
            "binary_version":  "2.4.16-1ubuntu1.3"
        },
        {
            "binary_name":  "cups-daemon",
            "binary_version":  "2.4.16-1ubuntu1.3"
        },
        {
            "binary_name":  "cups-ipp-utils",
            "binary_version":  "2.4.16-1ubuntu1.3"
        },
        {
            "binary_name":  "cups-ppdc",
            "binary_version":  "2.4.16-1ubuntu1.3"
        },
        {
            "binary_name":  "cups-server-common",
            "binary_version":  "2.4.16-1ubuntu1.3"
        },
        {
            "binary_name":  "libcups2t64",
            "binary_version":  "2.4.16-1ubuntu1.3"
        },
        {
            "binary_name":  "libcupsimage2t64",
            "binary_version":  "2.4.16-1ubuntu1.3"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-107890.json"
Ubuntu:26.10
cups

Package

Name
cups
Purl
pkg:deb/ubuntu/cups?arch=source&distro=stonking

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.4.16-1ubuntu1
2.4.16-1ubuntu3

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "cups",
            "binary_version":  "2.4.16-1ubuntu3"
        },
        {
            "binary_name":  "cups-bsd",
            "binary_version":  "2.4.16-1ubuntu3"
        },
        {
            "binary_name":  "cups-client",
            "binary_version":  "2.4.16-1ubuntu3"
        },
        {
            "binary_name":  "cups-common",
            "binary_version":  "2.4.16-1ubuntu3"
        },
        {
            "binary_name":  "cups-core-drivers",
            "binary_version":  "2.4.16-1ubuntu3"
        },
        {
            "binary_name":  "cups-daemon",
            "binary_version":  "2.4.16-1ubuntu3"
        },
        {
            "binary_name":  "cups-ipp-utils",
            "binary_version":  "2.4.16-1ubuntu3"
        },
        {
            "binary_name":  "cups-ppdc",
            "binary_version":  "2.4.16-1ubuntu3"
        },
        {
            "binary_name":  "cups-server-common",
            "binary_version":  "2.4.16-1ubuntu3"
        },
        {
            "binary_name":  "libcups2t64",
            "binary_version":  "2.4.16-1ubuntu3"
        },
        {
            "binary_name":  "libcupsimage2t64",
            "binary_version":  "2.4.16-1ubuntu3"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-107890.json"
Ubuntu:Pro:16.04:LTS
cups

Package

Name
cups
Purl
pkg:deb/ubuntu/cups?arch=source&distro=esm-infra-legacy%2Fxenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.1.0-4ubuntu3
2.1.0-5
2.1.0-6
2.1.0-6ubuntu1
2.1.0-7
2.1.2-1
2.1.2-2
2.1.3-1
2.1.3-1build1
2.1.3-3
2.1.3-4
2.1.3-4ubuntu0.2
2.1.3-4ubuntu0.3
2.1.3-4ubuntu0.4
2.1.3-4ubuntu0.5
2.1.3-4ubuntu0.6
2.1.3-4ubuntu0.7
2.1.3-4ubuntu0.8
2.1.3-4ubuntu0.9
2.1.3-4ubuntu0.10
2.1.3-4ubuntu0.11
2.1.3-4ubuntu0.11+esm1
2.1.3-4ubuntu0.11+esm2
2.1.3-4ubuntu0.11+esm3
2.1.3-4ubuntu0.11+esm4
2.1.3-4ubuntu0.11+esm5
2.1.3-4ubuntu0.11+esm6
2.1.3-4ubuntu0.11+esm7
2.1.3-4ubuntu0.11+esm8
2.1.3-4ubuntu0.11+esm9
2.1.3-4ubuntu0.11+esm11
2.1.3-4ubuntu0.11+esm12
2.1.3-4ubuntu0.11+esm13

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "cups",
            "binary_version":  "2.1.3-4ubuntu0.11+esm13"
        },
        {
            "binary_name":  "cups-bsd",
            "binary_version":  "2.1.3-4ubuntu0.11+esm13"
        },
        {
            "binary_name":  "cups-client",
            "binary_version":  "2.1.3-4ubuntu0.11+esm13"
        },
        {
            "binary_name":  "cups-common",
            "binary_version":  "2.1.3-4ubuntu0.11+esm13"
        },
        {
            "binary_name":  "cups-core-drivers",
            "binary_version":  "2.1.3-4ubuntu0.11+esm13"
        },
        {
            "binary_name":  "cups-daemon",
            "binary_version":  "2.1.3-4ubuntu0.11+esm13"
        },
        {
            "binary_name":  "cups-ipp-utils",
            "binary_version":  "2.1.3-4ubuntu0.11+esm13"
        },
        {
            "binary_name":  "cups-ppdc",
            "binary_version":  "2.1.3-4ubuntu0.11+esm13"
        },
        {
            "binary_name":  "cups-server-common",
            "binary_version":  "2.1.3-4ubuntu0.11+esm13"
        },
        {
            "binary_name":  "libcups2",
            "binary_version":  "2.1.3-4ubuntu0.11+esm13"
        },
        {
            "binary_name":  "libcupscgi1",
            "binary_version":  "2.1.3-4ubuntu0.11+esm13"
        },
        {
            "binary_name":  "libcupsimage2",
            "binary_version":  "2.1.3-4ubuntu0.11+esm13"
        },
        {
            "binary_name":  "libcupsmime1",
            "binary_version":  "2.1.3-4ubuntu0.11+esm13"
        },
        {
            "binary_name":  "libcupsppdc1",
            "binary_version":  "2.1.3-4ubuntu0.11+esm13"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-107890.json"
Ubuntu:Pro:18.04:LTS
cups

Package

Name
cups
Purl
pkg:deb/ubuntu/cups?arch=source&distro=esm-infra%2Fbionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.2.4-7ubuntu2
2.2.5-2
2.2.6-2
2.2.6-3
2.2.6-4
2.2.6-5
2.2.7-1ubuntu1
2.2.7-1ubuntu2
2.2.7-1ubuntu2.1
2.2.7-1ubuntu2.2
2.2.7-1ubuntu2.3
2.2.7-1ubuntu2.4
2.2.7-1ubuntu2.5
2.2.7-1ubuntu2.6
2.2.7-1ubuntu2.7
2.2.7-1ubuntu2.8
2.2.7-1ubuntu2.9
2.2.7-1ubuntu2.10
2.2.7-1ubuntu2.10+esm1
2.2.7-1ubuntu2.10+esm2
2.2.7-1ubuntu2.10+esm3
2.2.7-1ubuntu2.10+esm4
2.2.7-1ubuntu2.10+esm5
2.2.7-1ubuntu2.10+esm6
2.2.7-1ubuntu2.10+esm7
2.2.7-1ubuntu2.10+esm9
2.2.7-1ubuntu2.10+esm10

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "cups",
            "binary_version":  "2.2.7-1ubuntu2.10+esm10"
        },
        {
            "binary_name":  "cups-bsd",
            "binary_version":  "2.2.7-1ubuntu2.10+esm10"
        },
        {
            "binary_name":  "cups-client",
            "binary_version":  "2.2.7-1ubuntu2.10+esm10"
        },
        {
            "binary_name":  "cups-common",
            "binary_version":  "2.2.7-1ubuntu2.10+esm10"
        },
        {
            "binary_name":  "cups-core-drivers",
            "binary_version":  "2.2.7-1ubuntu2.10+esm10"
        },
        {
            "binary_name":  "cups-daemon",
            "binary_version":  "2.2.7-1ubuntu2.10+esm10"
        },
        {
            "binary_name":  "cups-ipp-utils",
            "binary_version":  "2.2.7-1ubuntu2.10+esm10"
        },
        {
            "binary_name":  "cups-ppdc",
            "binary_version":  "2.2.7-1ubuntu2.10+esm10"
        },
        {
            "binary_name":  "cups-server-common",
            "binary_version":  "2.2.7-1ubuntu2.10+esm10"
        },
        {
            "binary_name":  "libcups2",
            "binary_version":  "2.2.7-1ubuntu2.10+esm10"
        },
        {
            "binary_name":  "libcupscgi1",
            "binary_version":  "2.2.7-1ubuntu2.10+esm10"
        },
        {
            "binary_name":  "libcupsimage2",
            "binary_version":  "2.2.7-1ubuntu2.10+esm10"
        },
        {
            "binary_name":  "libcupsmime1",
            "binary_version":  "2.2.7-1ubuntu2.10+esm10"
        },
        {
            "binary_name":  "libcupsppdc1",
            "binary_version":  "2.2.7-1ubuntu2.10+esm10"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-107890.json"
Ubuntu:Pro:20.04:LTS
cups

Package

Name
cups
Purl
pkg:deb/ubuntu/cups?arch=source&distro=esm-infra%2Ffocal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.2.12-2ubuntu1
2.3.0-6
2.3.0-7
2.3.0-7ubuntu1
2.3.1-1ubuntu1
2.3.1-2
2.3.1-4
2.3.1-7
2.3.1-9ubuntu1
2.3.1-9ubuntu1.1
2.3.1-9ubuntu1.2
2.3.1-9ubuntu1.3
2.3.1-9ubuntu1.4
2.3.1-9ubuntu1.5
2.3.1-9ubuntu1.6
2.3.1-9ubuntu1.7
2.3.1-9ubuntu1.8
2.3.1-9ubuntu1.9
2.3.1-9ubuntu1.9+esm1
2.3.1-9ubuntu1.9+esm3
2.3.1-9ubuntu1.9+esm4

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "cups",
            "binary_version":  "2.3.1-9ubuntu1.9+esm4"
        },
        {
            "binary_name":  "cups-bsd",
            "binary_version":  "2.3.1-9ubuntu1.9+esm4"
        },
        {
            "binary_name":  "cups-client",
            "binary_version":  "2.3.1-9ubuntu1.9+esm4"
        },
        {
            "binary_name":  "cups-common",
            "binary_version":  "2.3.1-9ubuntu1.9+esm4"
        },
        {
            "binary_name":  "cups-core-drivers",
            "binary_version":  "2.3.1-9ubuntu1.9+esm4"
        },
        {
            "binary_name":  "cups-daemon",
            "binary_version":  "2.3.1-9ubuntu1.9+esm4"
        },
        {
            "binary_name":  "cups-ipp-utils",
            "binary_version":  "2.3.1-9ubuntu1.9+esm4"
        },
        {
            "binary_name":  "cups-ppdc",
            "binary_version":  "2.3.1-9ubuntu1.9+esm4"
        },
        {
            "binary_name":  "cups-server-common",
            "binary_version":  "2.3.1-9ubuntu1.9+esm4"
        },
        {
            "binary_name":  "libcups2",
            "binary_version":  "2.3.1-9ubuntu1.9+esm4"
        },
        {
            "binary_name":  "libcupsimage2",
            "binary_version":  "2.3.1-9ubuntu1.9+esm4"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-107890.json"