USN-7912-1: CUPS vulnerability

USN-7912-1: CUPS vulnerability

Publication date : 4 December 2025
Overview: CUPS could be made to stop responding if it received specially crafted network traffic.

Packages
cups - Common UNIX Printing System(tm)

Details
Johannes Meixner and Paul Zirnik discovered that CUPS incorrectly handled
clients that send messages slowly. A remote attacker could possibly use
this issue to cause CUPS to stop responding, resulting in a denial of
service. (CVE-2025-58436)

In addition, this update fixes a regression introduced in USN-7897-1 which
resulted in certain invalid configuration file directives to cause the CUPS
daemon to fail to start.

Update instructions
In general, a standard system update will make all the necessary changes.

The problem can be corrected by updating your system to the following package versions:

25.10 questing

• cups – 2.4.12-0ubuntu3.5
• cups-daemon – 2.4.12-0ubuntu3.5

25.04 plucky

• cups – 2.4.12-0ubuntu1.6
• cups-daemon – 2.4.12-0ubuntu1.6

24.04 LTS noble

• cups – 2.4.7-1.2ubuntu7.9
• cups-daemon – 2.4.7-1.2ubuntu7.9

22.04 LTS jammy

• cups – 2.4.1op1-1ubuntu4.16
• cups-daemon – 2.4.1op1-1ubuntu4.16