CRLF injection in cups - #VU154067
Published: October 12, 2026
Vulnerability details
The vulnerability allows a remote user to control a print queue's filter selection and cause a denial of service.
The vulnerability exists due to improper neutralization of CRLF sequences in the scheduler's PPD update mechanism when validating and persisting keyword values from scheduler PPD status records. A remote user can supply an allowed PPD keyword whose value contains a carriage return followed by a cupsFilter2 directive to control a print queue's filter selection and cause a denial of service.
The demonstrated remote chain requires access from the adjacent network and permission to submit jobs to a shared legacy PostScript/PPD queue through a print path reaching pstops. The injected directive is used when a subsequent job is processed.