What's Changed

CUPS 2.4.20 provides amount of bug fixes and security fixes:

Assigned CVE ids:

• CVE-2025-55480, CVE-2026-61702, CVE-2026-87875, CVE-2026-87876, CVE-2026-55453, CVE-2026-55467, CVE-2026-105326

Several fixes use GHSA id of security advisory due long waiting time for CVE ids from CNA. Due our changed policy the fixes referencing GHSA id are for:

• vulnerabilities with CVSS < 7.0, which we take as lower priority vulnerabilities,
• issues which require print admin rights for triggering them,
• issues where its fix is security hardening patch/feature.

Per our security policy, issues which require print admin rights, or are security hardening patches, are not taken as vulnerability and they reference a security advisory due convenience.

More details in CHANGES.md.

Enjoy!

CUPS 2.4.19 fixes a regression in shared printing from non-local accounts (Issue #1557)

The new release 2.4.18 contains a hotfix after the CVE-2026-27447 fix:

• Fixed cupsd crash if user does not exist (Issue #1555)

I'm sorry for inconvenience and enjoy!

The new release 2.4.17 contains the following security fixes:

• CVE-2026-27447: The scheduler treated local user and group names as case-
  insensitive.
• CVE-2026-34978: The RSS notifier could write outside the scheduler's RSS
  directory.
• CVE-2026-34980: The scheduler did not filter control characters from option
  values.
• CVE-2026-34979: The scheduler did not always allocate enough memory for a
  job's options string.
• CVE-2026-34990: The scheduler incorrectly allowed local certificates over the
  loopback interface.
• CVE-2026-39314: Fixed the range check for job password strings.
• CVE-2026-39316: Fixed a printer subscription bug in the scheduler.
• CVE-2026-NNNNN: Fixed a SNMP string conversion bug in the backends.

where the last CVE number is requested from Github for several days now, the number will be corrected once we have one, but we decided to make a release to share the other fixes.

The release includes other fixes as well, listed in CHANGES.md.

Enjoy!

The hotfix release 2.4.16 includes fix for infinite loop in GTK, which was caused by change of internal behavior in libcups on which GTK depended on, and workaround for stopping the scheduler if configuration includes unknown directives.

The full list of changes is shown in CHANGES.md.

Enjoy!

The release CUPS 2.4.15 brings two CVE fixes:

• Fix various cupsd issues which cause local DoS (CVE-2025-61915)
• Fix unresponsive cupsd process caused by slow client (CVE-2025-58436)

and several bug fixes described in CHANGES.md.

Enjoy!

The hotfix release brings fix for installation process of localized templates and CUPS web UI home pages.

Enjoy!

The release 2.4.13 brings two CVE fixes - fix for important CVE-2025-58060 and fix for moderate CVE-2025-58364, together with several bug fixes.

The release includes a new feature - new attribute for printer and job objects - print-as-raster - which allows enforce rasterization of the file for IPP Everywhere/AirPrint printers, which supports PDF and raster document formats. The feature is useful for working around internal PDF issues in the printer firmware, for example missing diacritic when printing a PDF.

The detailed list of changes is available in CHANGES.md.

Enjoy the release!

The last planned release of CUPS 2.4.x series (the next will be 2.5.x series) contains several enhancements among set of bug fixes, such following cryptographic policies when using GnuTLS crypto provider and possibility to opt-out from this behavior, logging job debugging history if print queue backends fails, or raising alerts for certificate issues in IPPS backend.

The detailed list of changes is available in CHANGES.md.

Enjoy the new release!

CUPS 2.4.11 brings several bug fixes regarding IPP response validation, processing PPD values, Web UI support (checkbox support, modifying printers) and others fixes.

Detailed list of changes is available in CHANGES.md

Enjoy!