CVE-2026-64611— Libcupsfilters: cups-filters: libcupsfilters: cpu exhaustion via infinite loop in cfieee1284normalizemakemodel()
Quick assessment
Affected
Red Hat Red Hat Enterprise Linux 10
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
OpenPrinting libcupsfilters是OpenPrinting组织开源的一个打印过滤库。 OpenPrinting libcupsfilters 2.1.1及之前版本存在资源管理错误漏洞，该漏洞源于cfIEEE1284NormalizeMakeModel()函数在处理空model字段的IEEE-1284设备ID时进入无限循环，导致持续的CPU消耗。网络相邻的攻击者可通过广播特制的打印机广告利用此漏洞，导致拒绝服务。
Possible ATT&CK Techniques 1 AI
T1499 · Endpoint Denial of ServiceAffected Version Matrix 5
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | 1:2.0.0-13.el10_2< * |
unaffected |
any |
unaffected | ||
| Red Hat | Red Hat Enterprise Linux 7 | any |
unaffected |
| Red Hat | Red Hat Enterprise Linux 8 | any |
unaffected |
| Red Hat | Red Hat Enterprise Linux 9 | any |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-64611
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Libcupsfilters: cups-filters: libcupsfilters: cpu exhaustion via infinite loop in cfieee1284normalizemakemodel()
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in libcupsfilters. The cfIEEE1284NormalizeMakeModel() function enters an infinite loop when processing a printer-advertised IEEE-1284 device ID with an empty model field, causing sustained CPU consumption. A network-adjacent attacker could exploit this by broadcasting a specially crafted printer advertisement, leading to denial of service.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
不可达退出条件的循环(无限循环)
Source: CVE Program / CVE List V5
Vulnerability Title
OpenPrinting libcupsfilters 资源管理错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
OpenPrinting libcupsfilters是OpenPrinting组织开源的一个打印过滤库。 OpenPrinting libcupsfilters 2.1.1及之前版本存在资源管理错误漏洞，该漏洞源于cfIEEE1284NormalizeMakeModel()函数在处理空model字段的IEEE-1284设备ID时进入无限循环，导致持续的CPU消耗。网络相邻的攻击者可通过广播特制的打印机广告利用此漏洞，导致拒绝服务。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | 1:2.0.0-13.el10_2 ~ * |
cpe:/o:redhat:enterprise_linux:10.2
|
|
| Red Hat | Red Hat Enterprise Linux 10 | - |
cpe:/o:redhat:enterprise_linux:10
|
|
| Red Hat | Red Hat Enterprise Linux 7 | - |
cpe:/o:redhat:enterprise_linux:7
|
|
| Red Hat | Red Hat Enterprise Linux 8 | - |
cpe:/o:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 9 | - |
cpe:/o:redhat:enterprise_linux:9
|
|
II. Public POCs for CVE-2026-64611
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
Qwen3.6-35B-A3B
· 10016 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2026-64611
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-64611 (4)
Same Patch Batch · Red Hat · 2026-07-23 · 4 CVEs total
| CVE-2026-16745 | 8.8 HIGH | Odh-dashboard: odh-dashboard: backend port 8080 trusts x-forwarded-access-token without or |
| CVE-2026-6390 | 6.8 MEDIUM | Nano: gnu nano: arbitrary memory writes, information disclosure, or denial of service via |
| CVE-2026-12353 | 5.3 MEDIUM | Rhcs: memory leak during https connection leads to denial of service |
IV. Related Vulnerabilities
Same product: Red Hat Enterprise Linux 10
-
CVE-2026-103641
Gegl: gegl04: gegl: out-of-bounds read in the radiance hdr u -
CVE-2026-103399
Libsoup: soupserver: http/1 request smuggling via undrained -
CVE-2026-103242
Rpm: heap-based buffer overflow write in hex2binv() via a mi -
CVE-2026-102560
Libsoup: libsoup: heap buffer overflow during outgoing perme -
CVE-2026-102559
Libsoup: libsoup: heap buffer overflow during websocket clie
Same vendor: Red Hat
-
CVE-2026-95512
Freetype: freetype: denial of service via repeated subroutin -
CVE-2026-86345
389-ds-base: 389-ds-base: starttls plaintext-buffer retentio -
CVE-2026-86344
389-ds-base: 389-ds-base: unauthenticated worker-thread-pool -
CVE-2026-103884
Keycloak-services: keycloak-services: path traversal in x.50 -
CVE-2026-56098
Rubygem-katello: improper authorization logic allows resourc
Same weakness: CWE-835
-
CVE-2026-85476
Apache Thrift: c_glib `read_all` spins when the underlying r -
CVE-2026-94654
Apache Thrift: Python `TNonblockingServer` busy-loops and st -
CVE-2026-86535
Apache Thrift: A JSON member name can stall the Node server' -
CVE-2026-63575
PKCS#12 key derivation loops about 2^32 times on a zero or n -
CVE-2026-63570
Pkcs12Store.GetCertificateChain loops forever on cyclic issu
V. Comments for CVE-2026-64611
No comments yet