CVE-2026-55467: CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection') in OpenPrinting cups
Description
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the cupsdCreateJob option-string builder in scheduler/job.c maps attacker-controlled destination-uri and pre-dial-string values from a configured fax queue to the phone and faxPrefix options. Unlike ordinary IPP job attributes, these mapped fax values bypass the control-character sanitizer and are copied directly into the filter options argument. A user permitted to submit a job can therefore inject control characters into the downstream option stream. The reporter states that a downstream fax filter passing these values to a shell or modem command could execute code as lp, while the maintainer states that CUPS has no confidentiality or integrity impact because the only known code-executing filter is optional Foomatic and addressed separately, leaving possible disruption of the affected queue. This issue is fixed in version 2.4.20.
CVSS v3.1
Score 2.5low
Affected software
OpenPrinting
cups
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
OpenPrinting CUPS versions before 2.4.20 contain a CRLF injection vulnerability in the cupsdCreateJob option-string builder. Attacker-controlled destination-uri and pre-dial-string values from a configured fax queue are mapped to phone and faxPrefix options without proper control-character sanitization. These values are copied directly into the filter options argument, allowing injection of control characters. While a downstream fax filter passing these values to a shell or modem command could execute code as the lp user, the maintainer notes no confidentiality or integrity impact since the only known code-executing filter (optional Foomatic) is addressed separately. The main impact is potential disruption of the affected queue. The vulnerability is resolved in version 2.4.20.
Potential Impact
The vulnerability allows injection of control characters into the downstream option stream, which could disrupt the affected print queue. There is no confidentiality or integrity impact confirmed. Code execution risk is limited and addressed separately by the maintainer. Overall impact is low.
Mitigation Recommendations
Upgrade to OpenPrinting CUPS version 2.4.20 or later, where this vulnerability is fixed. No other mitigation is indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-16T22:10:37.608Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ad10e922cdf04f6564bcc15
Added to database: 10/15/2026, 17:34:10 UTC
Last enriched: 10/15/2026, 17:48:36 UTC
Last updated: 10/15/2026, 19:00:26 UTC
Views: 13
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.