CVE-2026-107890

OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation requests. IPP parsing creates unnamed separator attributes with IPP_TAG_ZERO, but add_job() converts these separators to IPP_TAG_JOB. During job startup, get_options()/ipp_length() subsequently calls strlen() on a NULL attribute name, terminating cupsd and disrupting all queues. A single crafted Print-Job request can trigger the crash when the client can reach the scheduler and submit jobs to an accepting, enabled queue supporting the submitted document format. Anonymous submission is possible when permitted by listener and access-control configuration.

• CWE-476

• https://github.com/OpenPrinting/cups/security/advisories/GHSA-wjc4-qhjr-5m5x

Published

Oct 9, 2026

Last Modified

Oct 9, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-10787Missing authorization in the deleted user groups API in Devo…4.3
• CVE-2026-107885OpenPrinting CUPS through 2.4.20 contains a resource-exhaust…3.3
• CVE-2026-107886OpenPrinting CUPS before 2.4.20 contains a double-free in pr…2.3
• CVE-2026-107888OpenPrinting CUPS before 2.4.20 contains a NULL pointer dere…5.1
• CVE-2026-107889A flaw was found in the login theme rendering component of K…5.5
• CVE-2026-10789A maliciously crafted webpage, when visited by a user with A…9.6
• CVE-2026-1079A native messaging host vulnerability in Pega Browser Extens…6
• CVE-2026-107908A heap-based out-of-bounds write in the BoltReadHandler func…9.8
• CVE-2026-107909A heap-based out-of-bounds write in the ws_read_frame functi…9.1
• CVE-2026-107910An improper authentication vulnerability in the is_authentic…8.1
• CVE-2026-107911A type confusion vulnerability in the _read_flags function (…7.5
• CVE-2026-107914Backdrop CMS 1.34 before 1.34.5 and 1.35 before 1.35.1 doesn…7.8