Read the docs
TI-2023-17077 Aliases CVE-2023-34241

CUPS vulnerable to use-after-free in cupsdAcceptClient()

Priority HIGH 70CWE-416Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · High
Fix status
Partial Red Hat: 8 fixed, 2 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.

Summary

OpenPrinting CUPS is a standards-based, open source printing system for Linux and other Unix-like operating systems. Starting in version 2.0.0 and prior to version 2.4.6, CUPS logs data of free memory to the logging service AFTER the connection has been closed, when it should have logged the data right before. This is a use-after-free bug that impacts the entire cupsd process. The exact cause of this issue is the function `httpClose(con->http)` being called in `scheduler/client.c`. The problem is that httpClose always, provided its argument is not null, frees the pointer at the end of the call, only for cupsdLogClient to pass the pointer to httpGetHostname. This issue happens in function `cupsdAcceptClient` if LogLevel is warn or higher and in two scenarios: there is a double-lookup for the IP Address (HostNameLookups Double is set in `cupsd.conf`) which fails to resolve, or if CUPS is compiled with TCP wrappers and the connection is refused by rules from `/etc/hosts.allow` and `/etc/hosts.deny`. Version 2.4.6 has a patch for this issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01383 72nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial cups (OpenPrinting): 2.4.6Red Hat: 4 advisoriesRed Hat: 8 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OpenPrintingcups2.0.0 to before 2.4.62.4.6Patch availableCNA
  • cups VendorOpenPrinting Affected 2.0.0 to before 2.4.6 Fixed in 2.4.6 Patch available CNA

CPE configurations NVD · 5

CPEVersionsRoleVendor
cpe:2.3:a:openprinting:cups:*:*:*:*:*:*:*:*2.2.0 to before 2.4.6VulnerableOpenPrinting
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*37VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*38VulnerableFedoraproject
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*before 11.7.9; 12.0.0 to before 12.6.8; 13.0 to before 13.5VulnerableApple
  • cpe:2.3:a:openprinting:cups:*:*:*:*:*:*:*:* Versions 2.2.0 to before 2.4.6 Vulnerable ·OpenPrinting
  • cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* Versions 37 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* Versions 38 Vulnerable ·Fedoraproject
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
  • cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* Versions before 11.7.9; 12.0.0 to before 12.6.8; 13.0 to before 13.5 Vulnerable ·Apple

Remediation

  • Fix · CNA cups (OpenPrinting) Fixed in 2.4.6

Red Hat 4 advisories

  • RHSA-2024:1409 Released 2024-03-19 · Red Hat rating Moderate
    cups security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.8) cups-1:2.2.6-51.el8_8.3, cups-client-1:2.2.6-51.el8_8.3, cups-devel-1:2.2.6-51.el8_8.3 +3
    • Red Hat Enterprise Linux BaseOS EUS (v.8.8) cups-1:2.2.6-51.el8_8.3, cups-libs-1:2.2.6-51.el8_8.3
  • RHSA-2024:1101 Released 2024-03-05 · Red Hat rating Moderate
    cups security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.6) cups-1:2.2.6-45.el8_6.4, cups-client-1:2.2.6-45.el8_6.4, cups-devel-1:2.2.6-45.el8_6.4 +3
    • Red Hat Enterprise Linux BaseOS EUS (v.8.6) cups-1:2.2.6-45.el8_6.4, cups-libs-1:2.2.6-45.el8_6.4
  • RHSA-2023:7165 Released 2023-11-14 · Red Hat rating Moderate
    cups security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 8) cups-1:2.2.6-54.el8_9, cups-client-1:2.2.6-54.el8_9, cups-devel-1:2.2.6-54.el8_9 +3
    • Red Hat Enterprise Linux BaseOS (v. 8) cups-1:2.2.6-54.el8_9, cups-libs-1:2.2.6-54.el8_9
Show 1 more Red Hat advisories
  • RHSA-2023:6596 Released 2023-11-07 · Red Hat rating Moderate
    cups security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 9) cups-1:2.3.3op2-21.el9, cups-client-1:2.3.3op2-21.el9, cups-devel-1:2.3.3op2-21.el9 +4
    • Red Hat Enterprise Linux BaseOS (v. 9) cups-1:2.3.3op2-21.el9, cups-libs-1:2.3.3op2-21.el9

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2023:7165
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2023:6596
Red Hat Enterprise Linux AppStream EUS (v.8.6)Fixed RHSA-2024:1101
Red Hat Enterprise Linux AppStream EUS (v.8.8)Fixed RHSA-2024:1409
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2023:7165
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2023:6596
Red Hat Enterprise Linux BaseOS EUS (v.8.6)Fixed RHSA-2024:1101
Red Hat Enterprise Linux BaseOS EUS (v.8.8)Fixed RHSA-2024:1409

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-34241

References

Exploit 1

Patch 1

Advisory 6

Other 3

  • TI-2025-35903 cups has Authentication bypass with AuthType Negotiate CVSS 3.1HIGH 8.0
  • TI-2026-27200 Path traversal in OpenPrinting cups CVSS 3.1MEDIUM 6.5
  • TI-2023-04157 OpenPrinting CUPS/libppd Postscript Parsing Heap Overflow CVSS 3.1HIGH 7.0
  • TI-2026-74874 Path traversal in OpenPrinting CUPS banner handling discloses files CVSS 3.1MEDIUM 5.3
  • TI-2026-27201 OpenPrinting CUPS: Heap overflow in `get_options()` CVSS 3.1MEDIUM 5.3
  • TI-2025-38265 OpenPrinting CUPS vulnerable to stack based out-of-bound write CVSS 3.1MEDIUM 6.7
See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences