There are 2 open security issues in trixie.
1 issue left for the package maintainer to handle:
- CVE-2026-64612:
(needs triaging)
A flaw was found in libcupsfilters and cups-filters. The PNG image reading function creates a libpng reader without installing an error recovery handler, causing the CUPS image filter process to abort when processing a malformed PNG file. An unauthenticated attacker could exploit this by submitting a specially crafted PNG print job, leading to denial of service of the in-flight print job.
You can find information about how to handle this issue in the security team's documentation.
1 ignored issue:
- CVE-2024-47850:
CUPS cups-browsed before 2.5b1 will send an HTTP POST request to an arbitrary destination and port in response to a single IPP UDP packet requesting a printer to be added, a different vulnerability than CVE-2024-47176. (The request is meant to probe the new printer but can be used to create DDoS amplification attacks.)
![[bug history graph]](https://qa.debian.org/data/bts/graphs/c/cups-filters.png){kind=link}