Ubuntu 20.x — End of Life
EOL Actively exploitedUbuntu 20.x reached end of life on Jul 22, 2021, 1919 days ago, and no longer receives security fixes. The most recent release in this series is 20.10. 25 CVEs are tracked for this series, including 4 actively exploited according to CISA KEV. 3 of them were published after the end of life of the affected cycle and will not get an official patch. The next major version is Ubuntu 21. See Ubuntu 21 →
Ubuntu 20.x — All releases
| Version | Released | Active support | EOL date | Latest patch | Status | Alert me |
|---|---|---|---|---|---|---|
| 20.10 | Oct 22, 2020 | Jul 22, 2021 | Jul 22, 2021 | 20.10 | EOL | |
| 20.04LTS | Apr 23, 2020 | Oct 1, 2022 | May 31, 2025 | 20.04.6 | EOL |
CVEs affecting Ubuntu 20.x (26)
| CVE | Severity | CVSS | EPSS | KEV | Cycle | Description | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-31431 | HIGH | 7.8 | 3.43% | KEV | 20.04 | In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-pla… | Apr 22, 2026 |
| CVE-2026-31431 | HIGH | 7.8 | 3.43% | KEV | 20.10 | In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-pla… | Apr 22, 2026 |
| CVE-2026-3888 | HIGH | 7.8 | 0.47% | — | 20.04 | Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap's private … | Mar 17, 2026 |
| CVE-2026-3497 | HIGH | 7.5 | 1.29% | — | 20.04 | Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions. This vulnerability affects the GSSAPI… | Mar 12, 2026 |
| CVE-2022-2586 | MEDIUM | 5.3 | 10.20% | KEV | 20.04 | It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-a… | Jan 8, 2024 |
| CVE-2023-1380 | HIGH | 7.1 | 16.52% | — | 20.04 | A slab-out-of-bound read problem was found in brcmf_get_assoc_ies in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cf… | Mar 27, 2023 |
| CVE-2022-1055 | HIGH | 7.8 | 0.50% | — | 20.04 | A use-after-free exists in the Linux Kernel in tc_new_tfilter that could allow a local attacker to gain privilege escala… | Mar 29, 2022 |
| CVE-2022-0492 | HIGH | 7.8 | 5.52% | KEV | 20.04 | A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. Th… | Mar 3, 2022 |
| CVE-2021-4034 | HIGH | 7.8 | 94.92% | KEV | 20.04 | A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool… | Jan 28, 2022 |
| CVE-2020-27171 | MEDIUM | 6.0 | 0.57% | — | 20.04 | An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c has an off-by-one error (with a resulta… | Mar 20, 2021 |
| CVE-2020-27170 | MEDIUM | 4.7 | 0.56% | — | 20.04 | An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c performs undesirable out-of-bounds spec… | Mar 20, 2021 |
| CVE-2021-27364 | HIGH | 7.1 | 0.96% | — | 20.04 | An issue was discovered in the Linux kernel through 5.11.3. drivers/scsi/scsi_transport_iscsi.c is adversely affected by… | Mar 7, 2021 |
| CVE-2020-29372 | MEDIUM | 4.7 | 0.40% | — | 20.04 | An issue was discovered in do_madvise in mm/madvise.c in the Linux kernel before 5.6.8. There is a race condition betwee… | Nov 28, 2020 |
| CVE-2020-13935 | HIGH | 7.5 | 86.60% | — | 20.04 | The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to… | Jul 14, 2020 |
| CVE-2020-13934 | HIGH | 7.5 | 64.12% | — | 20.04 | An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release… | Jul 14, 2020 |
| CVE-2019-20907 | HIGH | 7.5 | 2.98% | — | 20.04 | In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when o… | Jul 13, 2020 |
| CVE-2020-11996 | HIGH | 7.5 | 26.69% | — | 20.04 | A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5… | Jun 26, 2020 |
| CVE-2020-8619 | MEDIUM | 4.9 | 2.10% | — | 20.04 | In ISC BIND9 versions BIND 9.11.14 -> 9.11.19, BIND 9.14.9 -> 9.14.12, BIND 9.16.0 -> 9.16.3, BIND Supported Preview Edi… | Jun 17, 2020 |
| CVE-2020-13632 | MEDIUM | 5.5 | 0.60% | — | 20.04 | ext/fts3/fts3_snippet.c in SQLite before 3.32.0 has a NULL pointer dereference via a crafted matchinfo() query. | May 27, 2020 |
| CVE-2020-13631 | MEDIUM | 5.5 | 0.65% | — | 20.04 | SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables, related to alter.c an… | May 27, 2020 |
| CVE-2020-13630 | HIGH | 7.0 | 1.03% | — | 20.04 | ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature. | May 27, 2020 |
| CVE-2020-9484 | HIGH | 7.0 | 55.52% | — | 20.04 | When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a)… | May 20, 2020 |
| CVE-2019-9674 | HIGH | 7.5 | 5.63% | — | 20.04 | Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource consumption) via a… | Feb 4, 2020 |
| CVE-2020-8492 | MEDIUM | 6.5 | 6.61% | — | 20.04 | Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTT… | Jan 30, 2020 |
| CVE-2019-19462 | MEDIUM | 5.5 | 0.46% | — | 20.04 | relay_open in kernel/relay.c in the Linux kernel through 5.4.1 allows local users to cause a denial of service (such as … | Nov 30, 2019 |
| CVE-2019-19054 | MEDIUM | 4.7 | 0.44% | — | 20.04 | A memory leak in the cx23888_ir_probe() function in drivers/media/pci/cx23885/cx23888-ir.c in the Linux kernel through 5… | Nov 18, 2019 |
Ubuntu 20.x is EOL — migrate to Ubuntu 21.x
Ubuntu 21.x is the next major release. Plan your upgrade before Ubuntu 20.x stops receiving security patches.
Add a Ubuntu 20 EOL badge to your README
Show your users which Ubuntu version your project runs and whether it is still supported. The badge updates automatically. More formats and options →
[](https://eolcanary.com/explore/ubuntu/20)Frequently asked questions
Is Ubuntu 20 end of life?
Yes. All Ubuntu 20.x releases have reached end of life and no longer receive security patches. There are 25 known CVEs affecting Ubuntu 20.x. Migrate to Ubuntu 21.x as soon as possible.
What CVEs affect Ubuntu 20?
There are 25 CVEs tracked for Ubuntu 20.x and 4 listed in the CISA Known Exploited Vulnerabilities catalog. See the full list above with CVSS and EPSS scores.
What is the latest Ubuntu 20 version?
The latest Ubuntu 20.x patch release is 20.10, released on October 22, 2020. Always run the latest patch to benefit from all security fixes.
How to migrate from Ubuntu 20 to Ubuntu 21?
To migrate from Ubuntu 20 to Ubuntu 21: (1) review the official Ubuntu 21 migration guide for breaking changes, (2) update dependencies and configuration accordingly, (3) test thoroughly in a staging environment, (4) deploy with a rollback plan. Starting early gives you time to resolve compatibility issues before your current version reaches end of life.
Is it safe to run Ubuntu 20 in production?
No. Ubuntu 20 has reached end of life and security vulnerabilities are no longer patched. Critically, 4 CVEs affecting Ubuntu 20.x are in the CISA KEV catalog — meaning they are actively exploited in the wild. Upgrade to a supported version immediately.
Data sourced from endoflife.date · CVE data from NVD · EPSS from FIRST.org · KEV from CISA