CVE-2026-64611: libcupsfilters DoS Vulnerability

CVE-2026-64611 Overview

CVE-2026-64611 is an infinite loop vulnerability in libcupsfilters, a library used by the OpenPrinting CUPS ecosystem to process printer data. The flaw resides in the cfIEEE1284NormalizeMakeModel() function, which fails to terminate when parsing an IEEE-1284 device ID string that contains an empty model field. A network-adjacent attacker can broadcast a crafted printer advertisement to trigger sustained CPU consumption on any host that processes the message. The result is a denial of service condition on systems running vulnerable versions of libcupsfilters. The weakness is classified under [CWE-835] (Loop with Unreachable Exit Condition).

Critical Impact
A single crafted printer advertisement on the local network can drive CPU utilization to saturation on every host processing libcupsfilters output, disrupting printing services and degrading host performance.

Affected Products

OpenPrinting libcupsfilters
Linux distributions shipping libcupsfilters (including Red Hat Enterprise Linux)
Applications and services depending on libcupsfilters for printer discovery and IEEE-1284 device ID parsing

Discovery Timeline

2026-07-23 - CVE-2026-64611 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-64611

Vulnerability Analysis

The vulnerability lives in the cfIEEE1284NormalizeMakeModel() routine of libcupsfilters. This function parses IEEE-1284 device ID strings that printers advertise over the network. Device ID strings follow a key:value; format containing fields such as MFG, MDL, CMD, and DES. When the MDL (model) field is present but empty, the normalization loop never advances past the empty token. The loop's exit condition depends on consumption of characters that the empty field never provides, so control flow remains inside the parser indefinitely.

Because parsing occurs during routine printer discovery, no user interaction or authentication is required to reach the vulnerable code path. Any component that ingests advertisements from browsed printers, including cups-browsed and other consumers of libcupsfilters, will hang the processing thread and consume a CPU core.

Root Cause

The root cause is missing input validation on the model field of the IEEE-1284 device ID. The parser assumes that each field contains at least one character before the terminating ; delimiter. When the delimiter appears immediately after the MDL: key, the tokenizer neither advances its cursor nor breaks out of the loop, producing the unreachable exit condition characteristic of [CWE-835].

Attack Vector

An attacker on the same broadcast domain, or one able to inject printer discovery traffic reachable by the target, sends a printer advertisement whose IEEE-1284 device ID contains MDL:; or a semantically equivalent empty model field. Any host running a vulnerable version of libcupsfilters that processes the advertisement enters the infinite loop. Repeated advertisements can pin multiple cores and effectively deny printing services across a subnet.

No authenticated code execution or memory corruption occurs. The impact is limited to availability, as reflected in the CVSS vector which reports no confidentiality or integrity impact but high availability impact.

See the GitHub Security Advisory GHSA-rcq7-rv5g-j3r4 for upstream technical details.

Detection Methods for CVE-2026-64611

Indicators of Compromise

Sustained 100% CPU utilization by processes linked against libcupsfilters, including cups-browsed and CUPS filter binaries.
Unsolicited or malformed IEEE-1284 printer advertisements on UDP port 631 (IPP) or via DNS-SD/mDNS containing empty MDL: fields.
Unresponsive printing subsystems and stalled print queues coinciding with new devices appearing on the network.

Detection Strategies

Inspect IPP and mDNS traffic for device ID strings matching the pattern MDL:; or where the model token has zero length between delimiters.
Correlate high CPU usage of cups-browsed or CUPS filter processes with recent printer discovery events in system logs.
Baseline expected printer advertisements per subnet and alert on anomalous broadcast volumes from unknown sources.

Monitoring Recommendations

Collect journalctl output for the cups and cups-browsed units and forward it to a central log store for anomaly review.
Monitor per-process CPU counters on Linux print servers and workstations for prolonged single-thread saturation by CUPS components.
Capture network telemetry on TCP/UDP 631 and mDNS (UDP 5353) to enable retrospective analysis of malformed device advertisements.

How to Mitigate CVE-2026-64611

Immediate Actions Required

Apply vendor updates for libcupsfilters as soon as they are available from your distribution. Refer to the Red Hat CVE-2026-64611 Advisory for package status.
Restrict printer discovery traffic to trusted VLANs and block inbound IPP and mDNS from untrusted networks at the firewall.
Disable cups-browsed on hosts that do not require automatic network printer discovery.

Patch Information

Fixes are tracked upstream in the GitHub Security Advisory GHSA-rcq7-rv5g-j3r4 and downstream in the Red Hat Bugzilla Report #2502799. Distribution maintainers are shipping backported patches that add bounds checks in cfIEEE1284NormalizeMakeModel() to guarantee loop termination when the model field is empty. Rebuild or reinstall any application statically linked against libcupsfilters after applying the update.

Workarounds

Stop and mask the cups-browsed.service unit on systems that do not need automatic printer discovery.
Filter IPP (TCP/UDP 631) and mDNS (UDP 5353) traffic from untrusted network segments using host-based firewalls such as nftables or firewalld.
Segment printers onto a dedicated VLAN and permit only known print servers to receive printer advertisements.

bash

# Configuration example: disable cups-browsed and block IPP/mDNS from untrusted zones
sudo systemctl stop cups-browsed.service
sudo systemctl mask cups-browsed.service

# firewalld: drop IPP and mDNS from the public zone
sudo firewall-cmd --permanent --zone=public --remove-service=ipp
sudo firewall-cmd --permanent --zone=public --remove-service=ipp-client
sudo firewall-cmd --permanent --zone=public --remove-service=mdns
sudo firewall-cmd --reload