Back Linuxsecurity

Ubuntu 22.04 Python 2.7 Critical Denial of Service Vuln USN-8018

Linuxsecurity •LinuxSecurity Advisories • March 19, 2026

A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS - Ubuntu 14.04 LTS Summary: Several security issues were fixed in python2.7 Software Description: - python2.7: An interactive high-level object-oriented language Details: USN-8018-1 fixed CVE-2025-12084, CVE-2025-15282, CVE-2026-0672, CVE-2026-0865 for python3. This update provides the corresponding updates for python2.7. Original advisory details: Denis Ledoux discovered that Python incorrectly parsed email message headers. An attacker could possibly use this issue to inject arbitrary headers into email messages. This issue only affected python3.6, python3.7, python3.8, python3.9, python3.10, python3.11, python3.12, python3.13, and python3.14 packages. (CVE-2025-11468) Jacob Walls, Shai Berger, and Natalia Bidart discovered that Python inefficiently parsed XML input with quadratic complexity. An attacker

The problem can be corrected by updating your system to the following package versions: Ubuntu 22.04 LTS libpython2.7 2.7.18-13ubuntu1.5+esm8 Available with Ubuntu Pro python2.7 2.7.18-13ubuntu1.5+esm8 Available with Ubuntu Pro Ubuntu 20.04 LTS libpython2.7 2.7.18-1~20.04.7+esm9 Available with Ubuntu Pro python2.7 2.7.18-1~20.04.7+esm9 Available with Ubuntu Pro Ubuntu 18.04 LTS libpython2.7 2.7.17-1~18.04ubuntu1.13+esm14 Available with Ubuntu Pro python2.7 2.7.17-1~18.04ubuntu1.13+esm14 Available with Ubuntu Pro Ubuntu 16.04 LTS libpython2.7 2.7.12-1ubuntu0~16.04.18+esm19 Available with Ubuntu Pro python2.7 2.7.12-1ubuntu0~16.04.18+esm19 Available with Ubuntu Pro Ubuntu 14.04 LTS libpython2.7 2.7.6-8ubuntu0.6+esm29 Available with Ubuntu Pro python2.7 2.7.6-8ubuntu0.6+esm29 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes.

CVE-2025-12084, CVE-2025-15282, CVE-2026-0672, CVE-2026-0865

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerabilities in Python 2.7 Affecting Multiple Ubuntu Releases On March 19, 2026, Ubuntu released USN-8018-3 to address vulnerabilities in Python 2.7, which could lead to denial of service and header injection attacks. The vulnerabilities were originally reported in Python 3 and included CVE-2025-12084, CVE-2025-15282, CVE-2026-0672, and CVE-2026-0865. Affected systems include various Ubuntu LTS versions from 14.04 to 22.04. The vulnerabilities were discovered by multiple researchers, including Denis Ledoux and Jacob Walls. Attackers could exploit these vulnerabilities by sending malicious inputs, leading to potential resource exhaustion and arbitrary command injection. Users are advised to update their systems to the latest package versions to mitigate these risks. The updates are available through Ubuntu Pro. The vulnerabilities were published between December 2025 and January 2026, with the advisory released on the same day as the patch. 2 sources 72

Extracted Entities

Ubuntu 22.04 Python 2.7 Critical Denial of Service Vuln USN-8018

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (5)