USN-8976-1: Apt-Cacher vulnerability
Publication date
3 November 2026
Overview
Apt-Cacher could be made to return specially crafted HTTP responses.
Releases
Packages
- apt-cacher - Caching proxy server for Debian/Ubuntu software repositories
Details
It was discovered that Apt-Cacher did not properly handle encoded newline
characters in requests. A remote attacker could possibly use this issue to
perform HTTP response splitting attacks.
It was discovered that Apt-Cacher did not properly handle encoded newline
characters in requests. A remote attacker could possibly use this issue to
perform HTTP response splitting attacks.
Update instructions
After a standard system update you need to restart Apt-Cacher to make all the necessary changes.
Learn more about how to get the fixes.The problem can be corrected by updating your system to the following package versions:
| Ubuntu Release | Package Version | ||
|---|---|---|---|
| 16.04 LTS xenial | apt-cacher – 1.7.11ubuntu0.16.04.1~esm1 | ||
Reduce your security exposure
Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.