OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a client that connects to cupsd but sends slow messages, e.g. only one byte per second, delays cupsd as a whole, such that it becomes unusable by other clients. This issue has been patched in version 2.4.15.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0035 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2025-58436:
    OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior     to version 2.4.15, a client that connects to cupsd but sends slow messages, e.g. only one byte per second,     delays cupsd as a whole, such that it becomes unusable by other clients. This issue has been patched in     version 2.4.15.

    CVE-2025-61915:
    OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior     to version 2.4.15, a user in the lpadmin group can use the cups web ui to change the config and insert a     malicious line. Then the cupsd process which runs as root will parse the new config and cause an out-of-     bound write. This issue has been patched in version 2.4.15.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-042:02 advisory.

    * CUPS: Local denial-of-service via cupsd.conf update and related issues (CVE-2025-61915)
      * cups: Slow client communication leads to a possible DoS attack (CVE-2025-58436)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:0464 advisory.

    * CUPS: Local denial-of-service via cupsd.conf update and related issues (CVE-2025-61915)
      * cups: Slow client communication leads to a possible DoS attack (CVE-2025-58436)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:0596 advisory.

    * CUPS: Local denial-of-service via cupsd.conf update and related issues (CVE-2025-61915)
      * cups: Slow client communication leads to a possible DoS attack (CVE-2025-58436)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:0312 advisory.

    * CUPS: Local denial-of-service via cupsd.conf update and related issues (CVE-2025-61915)
      * cups: Slow client communication leads to a possible DoS attack (CVE-2025-58436)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:0464 advisory.

    * CUPS: Local denial-of-service via cupsd.conf update and related issues (CVE-2025-61915)

    * cups: Slow client communication leads to a possible DoS attack (CVE-2025-58436)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:0596 advisory.

    * CUPS: Local denial-of-service via cupsd.conf update and related issues (CVE-2025-61915)

    * cups: Slow client communication leads to a possible DoS attack (CVE-2025-58436)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-0596 advisory.

    - RHEL-129729 CVE-2025-58436 cups: Slow client communication leads to a possible DoS attack

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:0596 advisory.

    The Common UNIX Printing System (CUPS) provides a portable printing layer for Linux, UNIX, and similar     operating systems.

    Security Fix(es):

    * CUPS: Local denial-of-service via cupsd.conf update and related issues (CVE-2025-61915)

    * cups: Slow client communication leads to a possible DoS attack (CVE-2025-58436)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-027:01 advisory.

    * CUPS: Local denial-of-service via cupsd.conf update and related issues (CVE-2025-61915)
      * cups: Slow client communication leads to a possible DoS attack (CVE-2025-58436)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:0312 advisory.

    * CUPS: Local denial-of-service via cupsd.conf update and related issues (CVE-2025-61915)

    * cups: Slow client communication leads to a possible DoS attack (CVE-2025-58436)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:0312 advisory.

    The Common UNIX Printing System (CUPS) provides a portable printing layer for Linux, UNIX, and similar     operating systems.

    Security Fix(es):

    * CUPS: Local denial-of-service via cupsd.conf update and related issues (CVE-2025-61915)

    * cups: Slow client communication leads to a possible DoS attack (CVE-2025-58436)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:0464 advisory.

    The Common UNIX Printing System (CUPS) provides a portable printing layer for Linux, UNIX, and similar     operating systems.

    Security Fix(es):

    * CUPS: Local denial-of-service via cupsd.conf update and related issues (CVE-2025-61915)

    * cups: Slow client communication leads to a possible DoS attack (CVE-2025-58436)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-0464 advisory.

    - RHEL-129721 CVE-2025-58436 cups: Slow client communication leads to a possible DoS attack

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-0312 advisory.

    - RHEL-129746 CVE-2025-58436 cups: Slow client communication leads to a possible DoS attack

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1320 advisory.

    A client that connects to cupsd but sends slow messages, e.g. only one byte per second, delays cupsd as a     whole, such that it becomes unusable by other clients. (CVE-2025-58436)

    A user in the lpadmin group can use the cups web ui to change the config and insert a malicious line.Then     the cupsd process which runs as root will parse the new config and cause an out-of-bound write.
    (CVE-2025-61915)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-993319 advisory.

    OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior     to version 2.4.15, a client that connects to cupsd but sends slow messages, e.g. only one byte per second,     delays cupsd as a whole, such that it becomes unusable by other clients. This issue has been patched in     version 2.4.15.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0956 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2025-61915:
    OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior     to version 2.4.15, a user in the lpadmin group can use the cups web ui to change the config and insert a     malicious line. Then the cupsd process which runs as root will parse the new config and cause an out-of-     bound write. This issue has been patched in version 2.4.15.

    CVE-2025-58436:
    OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior     to version 2.4.15, a client that connects to cupsd but sends slow messages, e.g. only one byte per second,     delays cupsd as a whole, such that it becomes unusable by other clients. This issue has been patched in     version 2.4.15.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:4425-1 advisory.

    Security issues fixed:

    - CVE-2025-58436: single client sending slow messages to cupsd can delay the application and make it     unusable for other       clients (bsc#1244057).

    Other issues fixed:

    - Update the CVE-2025-58436 patch to fix a regression that causes GTK applications to hang (bsc#1254353).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-c09b980696 advisory.

    fix possible issue reported by OSH

    ----

    2.4.16 (fedora#2417970)

    rebuild due binutils bug (fedora#2418285)     fix division by zero crash in pstops (fedora#2415396)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.04 / 25.10 host has packages installed that are affected by a vulnerability as referenced in the USN-7912-1 advisory.

    Johannes Meixner and Paul Zirnik discovered that CUPS incorrectly handled clients that send messages     slowly. A remote attacker could possibly use this issue to cause CUPS to stop responding, resulting in a     denial of service. (CVE-2025-58436)

    In addition, this update fixes a regression introduced in USN-7897-1 which resulted in certain invalid     configuration file directives to cause the CUPS daemon to fail to start.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:4319-1 advisory.

    - The fix for CVE-2025-58436 causes a regression where       GTK applications will hang. (bsc#1254353)

      See also https://github.com/OpenPrinting/cups/issues/1429

      The fix has been temporary disabled.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the cups package has been released.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4290-1 advisory.

    - CVE-2025-61915: Fixed a local denial-of-service via cupsd.conf update and related issues. (bsc#1253783)
    - CVE-2025-58436: Fixed an issue where a slow client communication leads to a possible DoS attack.
    (bsc#1244057)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of cups installed on the remote host is prior to 2.4.15. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2025-331-01 advisory.

    New cups packages are available for Slackware 15.0 and -current to fix security issues.

Tenable has extracted the preceding description block directly from the cups security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior     to version 2.4.15, a client that connects to cupsd but sends slow messages, e.g. only one byte per second,     delays cupsd as a whole, such that it becomes unusable by other clients. This issue has been patched in     version 2.4.15. (CVE-2025-58436)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
296651	TencentOS Server 3: cups (TSSA-2026:0035)	Nessus	Tencent Local Security Checks	medium
293780	MiracleLinux 8 : cups-2.2.6-66.el8_10 (AXSA:2026-042:02)	Nessus	Miracle Linux Local Security Checks	medium
291527	AlmaLinux 10 : cups (ALSA-2026:0464)	Nessus	Alma Linux Local Security Checks	medium
291518	AlmaLinux 8 : cups (ALSA-2026:0596)	Nessus	Alma Linux Local Security Checks	medium
291345	AlmaLinux 9 : cups (ALSA-2026:0312)	Nessus	Alma Linux Local Security Checks	medium
284827	RockyLinux 10 : cups (RLSA-2026:0464)	Nessus	Rocky Linux Local Security Checks	medium
284826	RockyLinux 8 : cups (RLSA-2026:0596)	Nessus	Rocky Linux Local Security Checks	medium
284803	Oracle Linux 8 : cups (ELSA-2026-0596)	Nessus	Oracle Linux Local Security Checks	medium
284505	RHEL 8 : cups (RHSA-2026:0596)	Nessus	Red Hat Local Security Checks	medium
283743	MiracleLinux 9 : cups-2.3.3op2-34.el9_7.2 (AXSA:2026-027:01)	Nessus	Miracle Linux Local Security Checks	medium
283691	RockyLinux 9 : cups (RLSA-2026:0312)	Nessus	Rocky Linux Local Security Checks	medium
283545	RHEL 9 : cups (RHSA-2026:0312)	Nessus	Red Hat Local Security Checks	medium
283492	RHEL 10 : cups (RHSA-2026:0464)	Nessus	Red Hat Local Security Checks	medium
282610	Oracle Linux 10 : cups (ELSA-2026-0464)	Nessus	Oracle Linux Local Security Checks	medium
282482	Oracle Linux 9 : cups (ELSA-2026-0312)	Nessus	Oracle Linux Local Security Checks	medium
282397	Amazon Linux 2023 : cups, cups-client, cups-devel (ALAS2023-2025-1320)	Nessus	Amazon Linux Local Security Checks	medium
280877	Unity Linux 20.1070e Security Update: cups (UTSA-2025-993319)	Nessus	Unity Linux Local Security Checks	medium
279074	TencentOS Server 4: cups (TSSA-2025:0956)	Nessus	Tencent Local Security Checks	medium
279049	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : cups (SUSE-SU-2025:4425-1)	Nessus	SuSE Local Security Checks	medium
279044	Fedora 42 : cups (2025-c09b980696)	Nessus	Fedora Local Security Checks	medium
277582	Ubuntu 22.04 LTS / 24.04 LTS / 25.04 / 25.10 : CUPS vulnerability (USN-7912-1)	Nessus	Ubuntu Local Security Checks	medium
277541	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : cups (SUSE-SU-2025:4319-1)	Nessus	SuSE Local Security Checks	medium
277440	Photon OS 4.0: Cups PHSA-2025-4.0-0916	Nessus	PhotonOS Local Security Checks	medium
277439	Photon OS 5.0: Cups PHSA-2025-5.0-0697	Nessus	PhotonOS Local Security Checks	medium
277262	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : cups (SUSE-SU-2025:4290-1)	Nessus	SuSE Local Security Checks	medium
277192	Slackware Linux 15.0 / current cups Multiple Vulnerabilities (SSA:2025-331-01)	Nessus	Slackware Local Security Checks	medium
276954	Linux Distros Unpatched Vulnerability : CVE-2025-58436	Nessus	Misc.	medium

Detections

Analytics

CVE-2025-58436

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium