CVE-2026-107885: CWE-770 Allocation of Resources Without Limits or Throttling in OpenPrinting CUPS

OpenPrinting CUPS through version 2.4.20 contains a resource exhaustion vulnerability due to the scheduler suppressing timeout processing for all pending jobs whenever any client connection has an in-flight Send-Document operation. The suppression does not verify if the connection corresponds to the job being checked, allowing a client with access to the IPP service to hold an incomplete HTTP request with Send-Document headers before authorization. This prevents unrelated incomplete jobs from expiring, leading to accumulation of incomplete jobs until the MaxJobs limit is exhausted, resulting in denial of service for further print submissions. The suppression ends when the held connection closes.

The vulnerability can cause denial of service by exhausting the MaxJobs resource limit, preventing legitimate print jobs from being submitted. There is no impact on confidentiality or integrity, only availability is affected. The CVSS score is 3.3 (low severity), reflecting limited impact and requiring local or low-privilege access with no user interaction.

No official patch or fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to the IPP service to trusted clients to reduce risk of exploitation. Monitor for unusual accumulation of incomplete print jobs and close stale client connections to mitigate resource exhaustion.