OpenPrinting CUPS CVE-2026-107885

Exploitation requires (1) a client that is permitted to reach the CUPS IPP/HTTP service and (2) a configuration where Create-Job submission is allowed to that client - i.e., the attacker must be an authorized print submitter (PR:L), not an anonymous outsider. The trigger is holding an incomplete HTTP request containing parsed Send-Document headers open before operation authorization completes, which suppresses submission-timeout processing for all pending jobs. Limiting factors: impact is capped at the MaxJobs limit and is self-correcting once the held connection closes; there is no persistence, no data exposure, and no effect beyond blocking new job submissions. Default MaxJobs settings and access-control lists that restrict who may submit jobs materially reduce real-world exposure.

This is a genuinely low-priority issue despite being a real, well-described flaw. The official CVSS base score is only 3.3, and the vector (C:N/I:N/A:L, Scope Unchanged) correctly reflects that the sole impact is a bounded denial of service - exhaustion of the MaxJobs queue so that new legitimate print submissions are rejected - with no confidentiality or integrity loss and no code execution. There is a notable internal conflict in the signals: the official vector specifies AV:L (local attack vector), but the description explicitly states that 'a client allowed to reach the IPP service' can hold an incomplete HTTP request, which implies network reachability to the IPP/HTTP listener rather than purely local access - this discrepancy should be verified with the vendor advisory, and my independent assessment leans toward AV:N. PR:L is consistent with the requirement that the attacker be an authorized client permitted to submit jobs (Create-Job). No EPSS score, KEV listing, or POC was provided in the input; no public exploit identified at time of analysis. Even absent those signals, the low impact ceiling (a self-healing DoS that ends when the held connection closes) and the authentication/authorization prerequisite make this a routine-patch item rather than an emergency, though CUPS's ubiquity means defenders should still apply the fix in due course.

An attacker who is already an authorized CUPS client (permitted to reach the IPP service and submit jobs) opens an HTTP connection and sends a partial request containing parsed Send-Document headers but never completes it. While that connection is held open, the scheduler suppresses timeout expiry for all other pending incomplete jobs; the attacker opens additional incomplete Create-Job submissions until MaxJobs is reached, after which legitimate print jobs are rejected. No public exploit code was identified in the provided data.