SUSE-SU-2026:21787-1

This update for cups fixes the following issues

• CVE-2026-27447: Authorization bypass via case-insensitive group-member lookup (bsc#1261572).
• CVE-2026-34978: Path traversal in RSS notify-recipient-uri enables file write outside CacheDir/rss (bsc#1261571).
• CVE-2026-34979: Heap overflow in get_options() (bsc#1261570).
• CVE-2026-34980: Shared PostScript queue lets anonymous Print-Job requests reach lp code execution over the network (bsc#1261569).
• CVE-2026-34990: Local print admin token disclosure using temporary printers (bsc#1261568).
• CVE-2026-39314: negative job-password-supported attribute can lead to a denial of service (bsc#1261743).
• CVE-2026-39316: dangling subscription pointer can lead to a denial of service (bsc#1261742).
• CVE-2026-41079: crafted SNMP response can lead to stack-based out-of-bounds read and sensitive memory disclosure (bsc#1263116).

Changes for cups:

• Version upgrade to 2.4.19