CVE-2026-42626: HP ENVY 5000 Series Printer DoS Vulnerability

CVE-2026-42626 Overview

CVE-2026-42626 is a Denial of Service (DoS) vulnerability affecting HP ENVY 5000 series printers running firmware VERBASPP1N003.2237A.00. The flaw resides in how the printer handles concurrent Transmission Control Protocol (TCP) connections on port 9100, the JetDirect/RAW printing service. An unauthenticated attacker on the same network can open a persistent connection and send keep-alive packets, locking the printer's session threads in a waiting state. The firmware lacks connection timeouts and concurrent session limits, classifying the issue under Uncontrolled Resource Consumption [CWE-400].

Critical Impact
The printer becomes unresponsive to all user commands and print jobs, requiring manual restart to restore functionality. The attack can be re-initiated immediately after recovery.

Affected Products

HP ENVY 5000 series printers
Firmware version VERBASPP1N003.2237A.00
JetDirect/RAW printing service on TCP port 9100

Discovery Timeline

2026-05-22 - CVE-2026-42626 published to the National Vulnerability Database (NVD)
2026-05-22 - Last updated in NVD database

Technical Details for CVE-2026-42626

Vulnerability Analysis

The vulnerability stems from improper management of concurrent TCP sessions on the RAW printing port (9100). HP ENVY 5000 series printers expose this port to accept print jobs over the network without authentication. The firmware's networking stack allocates a worker thread for each inbound TCP connection and waits for a complete print job before releasing it.

Because the firmware enforces no idle timeout and no upper bound on concurrent sessions, an attacker can monopolize all available session threads. Once exhausted, the printer cannot service legitimate jobs or respond to local panel commands. Functional recovery requires a physical power cycle.

Root Cause

The root cause is uncontrolled resource consumption in the JetDirect listener. Connection handlers do not enforce inactivity timeouts and do not cap concurrent sockets per source address. Keep-alive traffic from a single client is sufficient to hold a worker thread indefinitely, starving the resource pool that serves print operations.

Attack Vector

The attacker requires network adjacency to the printer. An unauthenticated client opens a TCP socket to port 9100, completes the handshake, and transmits low-volume keep-alive bytes without ever closing the session. Repeating this across multiple sockets locks all available session threads, producing a persistent DoS state. No credentials, user interaction, or print job payload are required.

No verified proof-of-concept code is published in the CVE record. Technical details are described in the referenced Medium write-up by Jacob Masse.

Detection Methods for CVE-2026-42626

Indicators of Compromise

Long-lived TCP sessions to printer IP addresses on port 9100 that transmit minimal data
Repeated print job failures or print queue stalls reported by users on the same subnet
Printer becoming unresponsive to web management interface and front-panel input while powered on
Multiple simultaneous TCP connections to 9100 originating from a single source host

Detection Strategies

Monitor network flow data for unusual session duration to TCP 9100 exceeding typical print job length
Alert on a single source IP holding more than one concurrent connection to a printer's RAW print port
Correlate help desk tickets reporting printer hangs with NetFlow or firewall connection logs

Monitoring Recommendations

Capture NetFlow or IPFIX telemetry from VLANs hosting HP ENVY 5000 devices
Track printer availability through Simple Network Management Protocol (SNMP) polling and alert on extended unreachable states
Log firewall connection tables for port 9100 and review for outliers in bytes-per-session ratios

How to Mitigate CVE-2026-42626

Immediate Actions Required

Restrict TCP port 9100 to authorized print servers using firewall or access control list (ACL) rules
Place HP ENVY 5000 printers on a dedicated VLAN segmented from general user networks
Disable RAW/JetDirect printing if the deployment can rely on Internet Printing Protocol (IPP) or USB only
Power-cycle affected printers to recover from active DoS conditions

Patch Information

No vendor patch is referenced in the NVD entry at the time of publication. Consult HP support channels for firmware updates beyond VERBASPP1N003.2237A.00. Refer to the public disclosure write-up for additional technical context.

Workarounds

Block inbound connections to TCP 9100 at the network edge and permit only known print server addresses
Apply per-host connection rate limits on switches or firewalls supporting connection-state policies
Implement scheduled printer reboots to clear lingering sessions in environments where exposure cannot be eliminated
Disable network printing protocols that are unused in the environment to reduce attack surface

bash

# Example iptables rule restricting port 9100 to a single print server
iptables -A FORWARD -p tcp --dport 9100 -s 10.0.10.25 -d 10.0.20.50 -j ACCEPT
iptables -A FORWARD -p tcp --dport 9100 -d 10.0.20.50 -j DROP