On my Ubuntu 22.04 machine, cupsd itself is only listening on localhost, but cups-browsed (which is what has the vulnerability here) is listening on 0.0.0.0

Why does it even listens in UDP at this day and age?!

I believe it's implementing DNS-SD for network printer auto-discovery. I'm not terribly familiar with DNS-SD, but given that normal DNS is UDP based it would be unsurprising for DNS-SD to also use UDP.

DNS is actually UDP/TCP. It’s probably required for receiving unicast messages, if it’s using DNS-SD

To receive multicast messages, probably.

The purpose of cups-browsed is to listen on a UDP port which allows it to receive broadcasts from legacy cups servers on the local network, whereupon it will talk to cups and configure a local print queue for the printers on the discovered server.

A modern setup doesn't need it and doesn't use it.

OpenSUSE

But it looks like cups-browsed is only needed on the Internet; locally you only need mDNS.

mDNS doesn't allow the printer to register itself to your system, which is the (highly dubious!) purpose of cups-browsed.

Modern cups discovered printers via mDNS and does indeed automatically create temporary destinations for them. This only works with "IPP Everywhere" printers which are 'driverless', i.e., the risk of doing this is limited since there's no printer model-specific software that needs to be run on the local machine to print to a remote printer, as opposed to the legacy protocol implemented (apparently unsafely!) by cups-browsed.

on popOS I see 0.0.0.0:*

I'm not sure why it deviates from Debian and Ubuntu which its based on though

That's the wrong column of netstat output, I think. "0.0.0.0:*" stands in for the (non-existent) peer address of a listening port.

oh sorry yeah I copied the wrong column. the correct column is `0.0.0.0:631`

MX Linux