The Common UNIX Printing System (CUPS) in Red Hat Enterprise Linux 9.0 contains two security flaws: an authentication bypass vulnerability in the authorization handling mechanism (CVE-2025-58060) and a null pointer dereference in the ipp_read_io() function that can cause a remote denial of service (CVE-2025-58364). These issues have been addressed in updated CUPS packages released by Red Hat as part of security advisory RHSA-2025:16590. The vulnerabilities are rated as important by Red Hat Product Security. The update is available for multiple architectures including x86_64, ppc64le, aarch64, and s390x. The advisory references detailed CVE pages for additional information.

Successful exploitation of CVE-2025-58060 could allow an attacker to bypass authentication controls in CUPS, potentially enabling unauthorized actions related to printing services. CVE-2025-58364 could allow a remote attacker to cause a denial of service by triggering a null pointer dereference, leading to a crash of the CUPS service. These vulnerabilities affect Red Hat Enterprise Linux 9.0 and related distributions. There are no reports of known exploits in the wild at this time.

Red Hat has released updated CUPS packages that address both vulnerabilities. Users of affected Red Hat Enterprise Linux 9.0 systems should apply the security update described in advisory RHSA-2025:16590 promptly. Detailed instructions for applying the update are available at https://access.redhat.com/articles/11258. Since this is not a cloud service, remediation requires manual update by system administrators. Patch status is confirmed as available via the vendor advisory.