CUPS

Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 4 Last 12 months 73 Lifetime Memory safety 40 % Auth bypass 22 % Denial of service 18 % Code execution 12 % Latest advisories Loading the feed Overview CUPS is the standard printing system on Linux and other Unix-like platforms, built around the cupsd scheduler, the libcups library and the Internet Printing Protocol (IPP), so much of its logic parses untrusted network and printer-supplied data. The 2024 RCE chain (CVE-2024-47076, CVE-2024-47175, CVE-2024-47176, CVE-2024-47177) showed how attacker-controlled IPP attributes flowing through cups-browsed and libcups could lead to remote command execution, underscoring the value of scrutiny here. OpenPrinting runs a coordinated vulnerability disclosure program via GitHub private advisories with no bounty of its own; report through sorona.xyz and we pay you directly on qualified, reproduced findings, with up to 2x the base payout for hard, chained bugs. In scope cupsd, the CUPS scheduler and daemon, with particular attention to network-request handling (the default config listens only on loopback plus a domain socket, which lowers the CVSS attack-vector rating). libcups, the core client and shared library, and its parsers. IPP (Internet Printing Protocol) message parsing and request handling. cupsd.conf and cups.conf configuration handling and directive processing (see the recent local-DoS advisory GHSA-hxm8-vfpq-jrfc). Printer, PPD, and job data handling, along with the filters and backends shipped by OpenPrinting. Any OpenPrinting-provided software where a network request can reach parsing or execution code. Coverage is scoped to the OpenPrinting/cups repository governed by its own SECURITY.md; cups-browsed, libcupsfilters, and libppd live in sibling projects with separate policies, even though the 2024 chain (CVE-2024-47076/47175/47176/47177) spanned all of them. Out of scope Theoretical weaknesses with no demonstrated, working exploit; a reproducing PoC is required. Vulnerabilities that stem from misconfiguration, that is, deploying against the documented safe defaults. Issues caused by incorrect API usage in the calling software. Anything that exists only in non-production or unreleased code, which should be filed as a regular bug. Findings outside tagged production releases (semantic MAJOR.MINOR.PATCH with MAJOR at least 1) covered by the policy. Defects in downstream distribution packaging or third-party filters not maintained by OpenPrinting, absent a flaw in CUPS itself. Most-valued findings Daemon crashes or hangs against cupsd caused by a crafted network request (network-triggered DoS). Remote code execution reachable through OpenPrinting-provided software. Privilege escalation that enables unauthorized actions or information disclosure. Demonstrated memory-safety and input-validation weaknesses, including buffer overflow, use-after-free, out-of-bounds access, divide-by-zero, and input-validation failures. Injection through untrusted printer attributes, PPD, or filter data that reaches command execution or file write. Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Provide a reproducer, affected version numbers, impact analysis, and any known workaround or patch. Report only against supported production releases using semantic MAJOR.MINOR.PATCH versioning. Test against your own instances; do not send probes or exploits to printers or hosts you do not control. Do not run intrusive scanning against project infrastructure; validate locally and submit only confirmed, exploitable findings. Hold details confidential until a coordinated fix or disclosure window is agreed. Payout follows sorona.xyz's confirmation of a reproduced, qualified finding; chained or hard-to-exploit bugs may earn up to 2x the base. Disclosure OpenPrinting practices coordinated disclosure with stakeholders and CERT/CC; when the CVSS score is 7 or higher or a stakeholder requests it, a mutually agreed embargo sets the fix-release date, otherwise fixes ship immediately. sorona.xyz aligns payout and public write-up timing with that process. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability