Ubuntu 19.x — End of Life
EOL Actively exploitedUbuntu 19.x reached end of life on Jul 6, 2020, 2300 days ago, and no longer receives security fixes. The most recent release in this series is 19.10. 31 CVEs are tracked for this series, including 4 critical and 1 actively exploited according to CISA KEV. 1 of them was published after the end of life of the affected cycle and will not get an official patch. The next major version is Ubuntu 20. See Ubuntu 20 →
Ubuntu 19.x — All releases
| Version | Released | Active support | EOL date | Latest patch | Status | Alert me |
|---|---|---|---|---|---|---|
| 19.10 | Oct 17, 2019 | Jul 6, 2020 | Jul 6, 2020 | 19.10 | EOL | |
| 19.04 | Apr 18, 2019 | Jan 23, 2020 | Jan 23, 2020 | 19.04 | EOL |
CVEs affecting Ubuntu 19.x (41)
| CVE | Severity | CVSS | EPSS | KEV | Cycle | Description | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-31431 | HIGH | 7.8 | 3.43% | KEV | 19.10 | In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-pla… | Apr 22, 2026 |
| CVE-2026-31431 | HIGH | 7.8 | 3.43% | KEV | 19.04 | In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-pla… | Apr 22, 2026 |
| CVE-2020-13632 | MEDIUM | 5.5 | 0.60% | — | 19.10 | ext/fts3/fts3_snippet.c in SQLite before 3.32.0 has a NULL pointer dereference via a crafted matchinfo() query. | May 27, 2020 |
| CVE-2020-13631 | MEDIUM | 5.5 | 0.65% | — | 19.10 | SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables, related to alter.c an… | May 27, 2020 |
| CVE-2020-13630 | HIGH | 7.0 | 1.03% | — | 19.10 | ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature. | May 27, 2020 |
| CVE-2020-11494 | MEDIUM | 4.4 | 0.72% | — | 19.10 | An issue was discovered in slc_bump in drivers/net/can/slcan.c in the Linux kernel 3.16 through 5.6.2. It allows attacke… | Apr 2, 2020 |
| CVE-2020-8492 | MEDIUM | 6.5 | 6.61% | — | 19.10 | Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTT… | Jan 30, 2020 |
| CVE-2019-19965 | MEDIUM | 4.7 | 0.65% | — | 19.10 | In the Linux kernel through 5.4.6, there is a NULL pointer dereference in drivers/scsi/libsas/sas_discover.c because of … | Dec 25, 2019 |
| CVE-2019-11050 | MEDIUM | 4.8 | 7.62% | — | 19.04 | When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7… | Dec 23, 2019 |
| CVE-2019-11046 | LOW | 3.7 | 4.11% | — | 19.10 | In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP bcmath extension functions on some systems, includ… | Dec 23, 2019 |
| CVE-2019-11046 | LOW | 3.7 | 4.11% | — | 19.04 | In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP bcmath extension functions on some systems, includ… | Dec 23, 2019 |
| CVE-2019-11045 | LOW | 3.7 | 8.81% | — | 19.04 | In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP DirectoryIterator class accepts filenames with emb… | Dec 23, 2019 |
| CVE-2019-11045 | LOW | 3.7 | 8.81% | — | 19.10 | In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP DirectoryIterator class accepts filenames with emb… | Dec 23, 2019 |
| CVE-2019-1551 | MEDIUM | 5.3 | 14.29% | — | 19.10 | There is an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC a… | Dec 6, 2019 |
| CVE-2019-19244 | HIGH | 7.5 | 3.56% | — | 19.10 | sqlite3Select in select.c in SQLite 3.30.1 allows a crash if a sub-select uses both DISTINCT and window functions, and a… | Nov 25, 2019 |
| CVE-2019-19244 | HIGH | 7.5 | 3.56% | — | 19.04 | sqlite3Select in select.c in SQLite 3.30.1 allows a crash if a sub-select uses both DISTINCT and window functions, and a… | Nov 25, 2019 |
| CVE-2019-19083 | MEDIUM | 4.7 | 0.50% | — | 19.04 | Memory leaks in *clock_source_create() functions under drivers/gpu/drm/amd/display/dc in the Linux kernel before 5.3.8 a… | Nov 18, 2019 |
| CVE-2019-19083 | MEDIUM | 4.7 | 0.50% | — | 19.10 | Memory leaks in *clock_source_create() functions under drivers/gpu/drm/amd/display/dc in the Linux kernel before 5.3.8 a… | Nov 18, 2019 |
| CVE-2019-19082 | MEDIUM | 4.7 | 0.37% | — | 19.04 | Memory leaks in *create_resource_pool() functions under drivers/gpu/drm/amd/display/dc in the Linux kernel through 5.3.1… | Nov 18, 2019 |
| CVE-2019-19082 | MEDIUM | 4.7 | 0.37% | — | 19.10 | Memory leaks in *create_resource_pool() functions under drivers/gpu/drm/amd/display/dc in the Linux kernel through 5.3.1… | Nov 18, 2019 |
| CVE-2019-19066 | MEDIUM | 4.7 | 0.45% | — | 19.10 | A memory leak in the bfad_im_get_stats() function in drivers/scsi/bfa/bfad_attr.c in the Linux kernel through 5.3.11 all… | Nov 18, 2019 |
| CVE-2019-18197 | HIGH | 7.5 | 4.36% | — | 19.04 | In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't reset under certain circumstances. If the rel… | Oct 18, 2019 |
| CVE-2019-18197 | HIGH | 7.5 | 4.36% | — | 19.10 | In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't reset under certain circumstances. If the rel… | Oct 18, 2019 |
| CVE-2019-16866 | HIGH | 7.5 | 3.50% | — | 19.04 | Unbound before 1.9.4 accesses uninitialized memory, which allows remote attackers to trigger a crash via a crafted NOTIF… | Oct 3, 2019 |
| CVE-2019-16935 | MEDIUM | 6.1 | 4.65% | — | 19.04 | The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the se… | Sep 28, 2019 |
| CVE-2019-16168 | MEDIUM | 6.5 | 4.25% | — | 19.10 | In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missin… | Sep 9, 2019 |
| CVE-2019-16168 | MEDIUM | 6.5 | 4.25% | — | 19.04 | In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missin… | Sep 9, 2019 |
| CVE-2019-16056 | HIGH | 7.5 | 5.12% | — | 19.04 | An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The e… | Sep 6, 2019 |
| CVE-2019-15219 | MEDIUM | 4.6 | 0.71% | — | 19.04 | An issue was discovered in the Linux kernel before 5.1.8. There is a NULL pointer dereference caused by a malicious USB … | Aug 19, 2019 |
| CVE-2019-15218 | MEDIUM | 4.6 | 0.83% | — | 19.04 | An issue was discovered in the Linux kernel before 5.1.8. There is a NULL pointer dereference caused by a malicious USB … | Aug 19, 2019 |
| CVE-2019-15217 | MEDIUM | 4.6 | 0.68% | — | 19.04 | An issue was discovered in the Linux kernel before 5.2.3. There is a NULL pointer dereference caused by a malicious USB … | Aug 19, 2019 |
| CVE-2019-13962 | CRITICAL | 9.8 | 3.70% | — | 19.04 | lavc_CopyPicture in modules/codec/avcodec/video.c in VideoLAN VLC media player through 3.0.7 has a heap-based buffer ove… | Jul 18, 2019 |
| CVE-2019-13602 | HIGH | 7.8 | 2.09% | — | 19.04 | An Integer Underflow in MP4_EIA608_Convert() in modules/demux/mp4/mp4.c in VideoLAN VLC media player through 3.0.7.1 all… | Jul 14, 2019 |
| CVE-2019-13118 | MEDIUM | 5.3 | 5.05% | — | 19.10 | In numbers.c in libxslt 1.1.33, a type holding grouping characters of an xsl:number instruction was too narrow and an in… | Jul 1, 2019 |
| CVE-2019-13118 | MEDIUM | 5.3 | 5.05% | — | 19.04 | In numbers.c in libxslt 1.1.33, a type holding grouping characters of an xsl:number instruction was too narrow and an in… | Jul 1, 2019 |
| CVE-2019-13117 | MEDIUM | 5.3 | 6.28% | — | 19.10 | In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized read in xsltNumb… | Jul 1, 2019 |
| CVE-2019-13117 | MEDIUM | 5.3 | 6.28% | — | 19.04 | In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized read in xsltNumb… | Jul 1, 2019 |
| CVE-2019-10160 | CRITICAL | 9.8 | 5.22% | — | 19.04 | A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 af… | Jun 7, 2019 |
| CVE-2019-9948 | CRITICAL | 9.1 | 11.84% | — | 19.04 | urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypas… | Mar 23, 2019 |
| CVE-2019-9636 | CRITICAL | 9.8 | 7.67% | — | 19.04 | Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorre… | Mar 8, 2019 |
| CVE-2019-7317 | MEDIUM | 5.3 | 9.39% | — | 19.04 | png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called und… | Feb 4, 2019 |
Ubuntu 19.x is EOL — migrate to Ubuntu 20.x
Ubuntu 20.x is the next major release. Plan your upgrade before Ubuntu 19.x stops receiving security patches.
Add a Ubuntu 19 EOL badge to your README
Show your users which Ubuntu version your project runs and whether it is still supported. The badge updates automatically. More formats and options →
[](https://eolcanary.com/explore/ubuntu/19)Frequently asked questions
Is Ubuntu 19 end of life?
Yes. All Ubuntu 19.x releases have reached end of life and no longer receive security patches. There are 31 known CVEs affecting Ubuntu 19.x, including 4 critical. Migrate to Ubuntu 20.x as soon as possible.
What CVEs affect Ubuntu 19?
There are 31 CVEs tracked for Ubuntu 19.x, including 4 critical severity issues and 1 listed in the CISA Known Exploited Vulnerabilities catalog. See the full list above with CVSS and EPSS scores.
What is the latest Ubuntu 19 version?
The latest Ubuntu 19.x patch release is 19.10, released on October 17, 2019. Always run the latest patch to benefit from all security fixes.
How to migrate from Ubuntu 19 to Ubuntu 20?
To migrate from Ubuntu 19 to Ubuntu 20: (1) review the official Ubuntu 20 migration guide for breaking changes, (2) update dependencies and configuration accordingly, (3) test thoroughly in a staging environment, (4) deploy with a rollback plan. Starting early gives you time to resolve compatibility issues before your current version reaches end of life.
Is it safe to run Ubuntu 19 in production?
No. Ubuntu 19 has reached end of life and security vulnerabilities are no longer patched. Critically, 1 CVE affecting Ubuntu 19.x is in the CISA KEV catalog — meaning it is actively exploited in the wild. Upgrade to a supported version immediately.
Data sourced from endoflife.date · CVE data from NVD · EPSS from FIRST.org · KEV from CISA