Home Assistant: mDNS Server-Side Request Forgery

Summary Home Assistant Green is vulnerable to a Server-Side Request Forgery SSRF via the mDNS/Zeroconf IPP integration. An unauthenticated attacker on the local network can send a crafted mDNS response to trick Home Assistant into making HTTP requests to arbitrary hosts, including internal servic...

CVE-2026-91129

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.2.3, the IPP integration automatically processed unauthenticated ipp.tcp.local mDNS announcements in homeassistant/components/ipp/configflow.py, where asyncstepzeroconf passed...

EUVD-2026-84804

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.2.3, the IPP integration automatically processed unauthenticated ipp.tcp.local mDNS announcements in homeassistant/components/ipp/configflow.py, where asyncstepzeroconf passed...

CVE-2026-91129 Home Assistant: mDNS Server-Side Request Forgery

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.2.3, the IPP integration automatically processed unauthenticated ipp.tcp.local mDNS announcements in homeassistant/components/ipp/configflow.py, where asyncstepzeroconf passed...

CVE-2026-91129

The Home Assistant home automation software is vulnerable to a Server-Side Request Forgery (SSRF) flaw in the IPP integration (specifically within homeassistant/components/ipp/config_flow.py). Prior to version 2026.2.3 , the async_step_zeroconf function automatically processed unauthenticated _ip...

CVE-2026-91129 Home Assistant: mDNS Server-Side Request Forgery

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.2.3, the IPP integration automatically processed unauthenticated ipp.tcp.local mDNS announcements in homeassistant/components/ipp/configflow.py, where asyncstepzeroconf passed...

CVE-2026-91129 Home Assistant: mDNS Server-Side Request Forgery

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.2.3, the IPP integration automatically processed unauthenticated ipp.tcp.local mDNS announcements in homeassistant/components/ipp/configflow.py, where asyncstepzeroconf passed...

CVE-2026-91129: Server-Side Request Forgery (SSRF)

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.2.3, the IPP integration automatically processed unauthenticated ipp.tcp.local mDNS announcements in homeassistant/components/ipp/configflow.py, where asyncstepzeroconf passed...

NewStart CGSL MAIN 7.02 : cups-filters Vulnerability (NS-SA-2026-0089)

The remote NewStart CGSL host, running version MAIN 7.02, has cups-filters packages installed that are affected by a vulnerability: - libppd = 2.1b1 ppdCreatePPDFromIPP2 does not validate or sanitize the IPP attributes when writing them to a temporary PPD file, allowing the injection of attacker...

golang-github-openprinting-ipp-usb security update

An update is available for golang-github-openprinting-ipp-usb. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list HTTP reverse proxy, backed by IPP-over-USB...

RLSA-2026:62631 Important: golang-github-openprinting-ipp-usb security update

HTTP reverse proxy, backed by IPP-over-USB connection to device. It enables driverless support for USB devices capable of using IPP-over-USB protocol. Security Fixes: mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header CVE-2026-42504 encoding/asn1: golang: Go...

RHSA-2026:62631 Red Hat Security Advisory: golang-github-openprinting-ipp-usb security update

Bulletin has no description...

AlmaLinux 10 : golang-github-openprinting-ipp-usb (ALSA-2026:62631)

The remote AlmaLinux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:62631 advisory. mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header CVE-2026-42504 encoding/asn1: golang: Go encoding/asn1: Denial of Servi...

RockyLinux 10 : golang-github-openprinting-ipp-usb (RLSA-2026:62631)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:62631 advisory. mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header CVE-2026-42504 encoding/asn1: golang: Go encoding/asn1: Denial of...

RHEL 10 : golang-github-openprinting-ipp-usb (RHSA-2026:62631)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:62631 advisory. HTTP reverse proxy, backed by IPP-over-USB connection to device. It enables driverless support for USB devices capable of using IPP-over-U...

Oracle Linux 10 : ELSA-2026-62631-0: / golang-github-openprinting-ipp-usb (ELSA-2026-626310)

The remote Oracle Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-626310 advisory. 0.9.27-7.3 - Rebuilt with golang-1.26.7-1.el102 to fix CVE-2026-42504,CVE-2026-33818,CVE-2026-56853,CVE-2026-56859,CVE-2026-56860,CVE-2026-56862...

Important: Red Hat Security Advisory: golang-github-openprinting-ipp-usb security update

An update for golang-github-openprinting-ipp-usb is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available f...

ALSA-2026:62631 Important: golang-github-openprinting-ipp-usb security update

HTTP reverse proxy, backed by IPP-over-USB connection to device. It enables driverless support for USB devices capable of using IPP-over-USB protocol. Security Fixes: mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header CVE-2026-42504 encoding/asn1: golang: Go...

golang-github-openprinting-ipp-usb security update

0.9.27-7.3 - Rebuilt with golang-1.26.7-1.el102 to fix CVE-2026-42504,CVE-2026-33818,CVE-2026-56853,CVE-2026-56859,CVE-2026-56860,CVE-2026-56862...

PT-2026-93226

Name of the Vulnerable Software and Affected Versions Home Assistant versions prior to 2026.2.3 Description The IPP integration automatically processes unauthenticated ipp. tcp.local mDNS announcements. In the homeassistant/components/ipp/config flow.py file, the async step zeroconf function pass...