Linux CUPS Flaw Allows Remote Denial of Service and Authentication Bypass

Two critical security vulnerabilities have been discovered in the Common Unix Printing System (CUPS), a widely used printing subsystem for Unix-like operating systems, exposing Linux machines to remote denial-of-service attacks and authentication bypass. The flaws are tracked as CVE-2025-58364 and CVE-2025-58060, with CVSS scores of 6.5 and 7.3 respectively, and affect CUPS versions listed as <2.4.12 and <2.4.13.

Remote DoS arises from unsafe deserialization and validation of printer attributes during IPP_OP_GET_PRINTER_ATTRIBUTES processing, with attackers able to craft malicious printer attribute responses to trigger null dereference errors, as described by security advisories and corroborated by NVD entries according to NVD.

The authentication bypass can occur when non-Basic AuthType configurations are used, allowing attackers to bypass password verification by sending malformed basic authentication credentials, affecting installations below 2.4.13. At present, no patches have been released for these flaws, leaving mitigations largely at network level protections and service configuration changes.