CVE-2026-34979: 
Alma Linux vulnerability analysis and mitigation

CVE-2026-34979 is a heap-based buffer overflow vulnerability in the OpenPrinting CUPS scheduler, specifically in the get_options() function when building filter option strings from job attributes. It affects OpenPrinting CUPS versions 2.4.16 and prior, and was published on April 3, 2026. The vulnerability was assigned a CVSS v3.1 base score of 5.3 (Medium), reflecting a network-accessible, unauthenticated, low-complexity attack with availability impact only (GitHub Advisory, Red Hat Bugzilla). A patch was released in CUPS version 2.4.17 (OpenPrinting Release).

The root cause (CWE-122: Heap-based Buffer Overflow) lies in a size miscalculation within get_options() in the CUPS scheduler (scheduler/job.c). The allocation size for the options string is computed using ipp_length(), which unconditionally skips URI-type attributes; however, get_options() still serializes two URI attributes — job-uuid and job-authorization-uri — writing their values directly into the buffer without bounds checking. An attacker who can submit IPP print jobs can craft a Print-Job request with oversized job-uuid or job-authorization-uri attributes, causing an out-of-bounds write on the heap in cupsd. A public Python proof-of-concept exploit is available that sends such a crafted IPP request over HTTP to trigger a segfault in the CUPS daemon (GitHub Advisory).

Successful exploitation causes a crash (segfault) of the cupsd scheduler process, resulting in a denial of service for all print operations on the affected system. The advisory notes that while crash/DoS is the straightforward outcome, the underlying heap memory corruption may also be exploitable for code execution in more sophisticated attack scenarios. Confidentiality and integrity are not directly impacted under the current CVSS assessment, but the potential for memory corruption-based code execution cannot be fully ruled out (GitHub Advisory, Red Hat Bugzilla).

A functional Python proof-of-concept exploit is publicly available via the OpenPrinting CUPS GitHub security advisory, confirmed to trigger a heap overflow and crash cupsd via crafted IPP Print-Job requests. No authentication is required to exploit this vulnerability. The EPSS score is approximately 0.039%, indicating a currently low probability of widespread exploitation. There is no evidence of active in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Feedly).

1. Reconnaissance: Identify hosts running CUPS (typically listening on TCP port 631 or a custom port) using network scanners such as Nmap (nmap -p 631 --open <target_range>). Confirm the CUPS version is 2.4.16 or earlier.
2. Identify a target printer: Query the CUPS server for available printers (e.g., via lpstat -h <host> -p or by browsing http://<host>:631/printers/) to obtain a valid printer name for the IPP URI.
3. Craft the malicious IPP request: Using the public PoC Python script, construct an IPP Print-Job request containing oversized job-uuid and job-authorization-uri URI attributes (e.g., 12,000 bytes each). These values exceed the buffer allocated by ipp_length() since URI attributes are excluded from its size calculation.
4. Send the payload: Execute the PoC script targeting the CUPS server: python3 poc.py --host <target_ip> --port 631 --printer <printer_name> --uuid-len 12000 --auth-len 12000. The script sends the crafted request via HTTP POST to /printers/<printer_name>.
5. Trigger the crash: The CUPS scheduler (cupsd) processes the job attributes, writes the oversized URI values past the allocated heap buffer without bounds checking, causing a segfault and crashing the cupsd process — resulting in denial of service (GitHub Advisory).

• Network: Unexpected HTTP POST requests to /printers/<name> on TCP port 631 (or configured CUPS port) with Content-Type: application/ipp and unusually large payloads (tens of kilobytes); connections from untrusted or external IP addresses to the CUPS port.
• Logs: CUPS access log (/var/log/cups/access_log) entries showing Print-Job operations from unexpected source IPs; error log (/var/log/cups/error_log) entries indicating segmentation faults or abnormal termination of cupsd.
• Process: Unexpected termination and restart of the cupsd process; system logs (/var/log/syslog or journalctl) showing cupsd crash signals (SIGSEGV) correlated with incoming IPP requests.
• File System: Core dump files generated by cupsd crashes in /var/spool/cups/ or the system core dump directory, potentially timestamped around suspicious print job submissions (GitHub Advisory).

Upgrade OpenPrinting CUPS to version 2.4.17 or later, which contains the fix that expands the allocation of the options string to correctly account for URI attributes (job-uuid and job-authorization-uri) (OpenPrinting Release). Patches are also available through Red Hat, SUSE, Ubuntu (USN-8405-1), Amazon Linux, Slackware, and other Linux distributions (Red Hat Bugzilla, Ubuntu Advisory). As a workaround where patching is not immediately possible, restrict network access to the CUPS scheduler (port 631) to trusted hosts only using firewall rules, and monitor for suspicious IPP print job submissions.

The vulnerability was reported to OpenPrinting by researchers jacobgnewman and sprabhav7 (credited to Xint Code) and published as a GitHub security advisory rated Moderate (GitHub Advisory). Red Hat tracked the issue via Bugzilla and classified it as medium severity, with downstream distributions including SUSE, Ubuntu, Amazon Linux, Slackware, Fedora, and openSUSE issuing security updates. The oss-security mailing list also carried a disclosure notice (oss-sec). Community reaction has been measured given the Medium CVSS score and DoS-only confirmed impact, though the availability of a working PoC has prompted prompt patching across major Linux distributions.