# cups 2.4.19

OpenPrinting CUPS Sources

Snapshot of gominimal/pkgs commit `defad31c69130df153e9263cb1e4dca96b3e2994` (pushed 2026-07-24T23:32:58.000Z).

## Install

```sh
min add cups
```

## Direct advisories

| ID | Severity | CVSS | Fix status | Fixed version | Summary |
| --- | --- | --- | --- | --- | --- |
| GHSA-7hqf-mfhx-7r3v | LOW | 3.3 | unknown_fix | — | CUPS ipp backend status-line injection can update queue PPD and lead to conditional RCE as lp via foomatic-rip |

## Transitive advisories

8 advisories inherited through runtime dependencies:

- CVE-2013-4412 (HIGH) via glibc
- CVE-2026-4046 (HIGH) via glibc
- CVE-2026-4437 (HIGH) via glibc
- CVE-2026-4438 (MEDIUM) via glibc
- CVE-2026-5435 (HIGH) via glibc
- CVE-2026-5450 (CRITICAL) via glibc
- CVE-2026-5928 (HIGH) via glibc
- CVE-2026-6238 (MEDIUM) via glibc

## Dependencies

- Build (4): base, make, toolchain, pkgconf
- Runtime (3): openssl, zlib, glibc

## Scorecard

| Category | Score | Band |
| --- | --- | --- |
| supply-chain | 60 | mid |
| advisories | 10 | low |
| quality | 58 | mid |
| maintenance | 100 | perfect |
| licence | 100 | perfect |

## Links

- Homepage: https://openprinting.github.io/cups
- Package page (HTML): https://minimal.dev/pkgs/cups
- JSON API (floats latest): https://minimal.dev/api/pkgs/cups.json
- SBOM (CycloneDX 1.5): https://minimal.dev/api/pkgs/cups/sbom.json