CVE catalog
CVE-2025-6966
python-apt vulnerability
- Severity
- Medium · CVSS 6.9
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.14% · Oct 25, 2026
NULL pointer dereference in TagSection.keys() in python-apt on APT-based Linux systems allows a local attacker to cause a denial of service (process crash) via a crafted deb822 file with a malformed non-UTF-8 key.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | python-apt | sid | 3.1.0 | fixed |
| Debian | python-apt | forky | 3.1.0 | fixed |
| Debian | python-apt | trixie | 3.0.0 | vulnerable |
| Debian | python-apt | bookworm | 2.6.0 | vulnerable |
| Ubuntu | python-apt | noble | Not reported | vulnerable |
| Ubuntu | python-apt | noble | 2.7.7ubuntu5.1 | fixed |
| Ubuntu | python-apt-common | noble | 2.7.7ubuntu5.1 | fixed |
| Ubuntu | python-apt-dev | noble | 2.7.7ubuntu5.1 | fixed |
| Ubuntu | python-apt-doc | noble | 2.7.7ubuntu5.1 | fixed |
| Ubuntu | python3-apt | noble | 2.7.7ubuntu5.1 | fixed |
| Cpe | python-apt | Not reported | Not reported | unknown |
| Ubuntu | python-apt | pro | 1.9.0ubuntu1 | vulnerable |
| Ubuntu | python-apt | pro | 1.9.0ubuntu3 | vulnerable |
| Ubuntu | python-apt | pro | 1.9.0ubuntu5 | vulnerable |
| Ubuntu | python-apt | pro | 1.9.3ubuntu2 | vulnerable |
| Ubuntu | python-apt | pro | 1.9.5 | vulnerable |
| Ubuntu | python-apt | pro | 1.9.5build1 | vulnerable |
| Ubuntu | python-apt | pro | 1.9.7 | vulnerable |
| Ubuntu | python-apt | pro | 1.9.8 | vulnerable |
| Ubuntu | python-apt | pro | 1.9.10 | vulnerable |
| Ubuntu | python-apt | pro | 2.0.0 | vulnerable |
| Ubuntu | python-apt | pro | 2.0.0ubuntu0.20.04.1 | vulnerable |
| Ubuntu | python-apt | pro | 2.0.0ubuntu0.20.04.2 | vulnerable |
| Ubuntu | python-apt | pro | 2.0.0ubuntu0.20.04.3 | vulnerable |
| Ubuntu | python-apt | pro | 2.0.0ubuntu0.20.04.4 | vulnerable |
| Ubuntu | python-apt | pro | 2.0.0ubuntu0.20.04.5 | vulnerable |
| Ubuntu | python-apt | pro | 2.0.0ubuntu0.20.04.6 | vulnerable |
| Ubuntu | python-apt | pro | 2.0.0ubuntu0.20.04.7 | vulnerable |
| Ubuntu | python-apt | pro | 2.0.0ubuntu0.20.04.8 | vulnerable |
| Ubuntu | python-apt | pro | 2.0.1 | vulnerable |
| Ubuntu | python-apt | pro | 2.0.1ubuntu0.20.04.1 | vulnerable |
| Ubuntu | python-apt | pro | 2.0.1ubuntu0.20.04.1+esm1 | fixed |
| Ubuntu | python-apt | 22.04 | 2.2.1 | vulnerable |
| Ubuntu | python-apt | 22.04 | 2.3.0 | vulnerable |
| Ubuntu | python-apt | 22.04 | 2.3.0ubuntu1 | vulnerable |
| Ubuntu | python-apt | 22.04 | 2.3.0ubuntu2 | vulnerable |
| Ubuntu | python-apt | 22.04 | 2.3.0ubuntu2.1 | vulnerable |
| Ubuntu | python-apt | 22.04 | 2.4.0 | vulnerable |
| Ubuntu | python-apt | 22.04 | 2.4.0ubuntu1 | vulnerable |
| Ubuntu | python-apt | 22.04 | 2.4.0ubuntu2 | vulnerable |
| Ubuntu | python-apt | 22.04 | 2.4.0ubuntu3 | vulnerable |
| Ubuntu | python-apt | 22.04 | 2.4.0ubuntu4 | vulnerable |
| Ubuntu | python-apt | 22.04 | 2.4.0ubuntu4.1 | fixed |
| Ubuntu | python-apt | 24.04 | 2.6.0ubuntu1 | vulnerable |
| Ubuntu | python-apt | 24.04 | 2.6.0ubuntu2 | vulnerable |
| Ubuntu | python-apt | 24.04 | 2.7.0 | vulnerable |
| Ubuntu | python-apt | 24.04 | 2.7.5 | vulnerable |
| Ubuntu | python-apt | 24.04 | 2.7.6 | vulnerable |
| Ubuntu | python-apt | 24.04 | 2.7.7 | vulnerable |
| Ubuntu | python-apt | 24.04 | 2.7.7build1 | vulnerable |
| Ubuntu | python-apt | 24.04 | 2.7.7ubuntu1 | vulnerable |
| Ubuntu | python-apt | 24.04 | 2.7.7ubuntu2 | vulnerable |
| Ubuntu | python-apt | 24.04 | 2.7.7ubuntu3 | vulnerable |
| Ubuntu | python-apt | 24.04 | 2.7.7ubuntu4 | vulnerable |
| Ubuntu | python-apt | 24.04 | 2.7.7ubuntu5 | vulnerable |
| Ubuntu | python-apt | 24.04 | 2.7.7ubuntu5.1 | fixed |
| Ubuntu | python-apt | 25.10 | 3.0.0 | vulnerable |
| Ubuntu | python-apt | 25.10 | 3.0.0ubuntu1 | vulnerable |
| Ubuntu | python-apt | 25.10 | 3.0.0ubuntu1.1 | fixed |
| Ubuntu | python-apt | pro | 1.9.0ubuntu1 | vulnerable |
| Ubuntu | python-apt | pro | 1.9.0ubuntu3 | vulnerable |
| Ubuntu | python-apt | pro | 1.9.0ubuntu5 | vulnerable |
| Ubuntu | python-apt | pro | 1.9.3ubuntu2 | vulnerable |
| Ubuntu | python-apt | pro | 1.9.5 | vulnerable |
| Ubuntu | python-apt | pro | 1.9.5build1 | vulnerable |
| Ubuntu | python-apt | pro | 1.9.7 | vulnerable |
| Ubuntu | python-apt | pro | 1.9.8 | vulnerable |
| Ubuntu | python-apt | pro | 1.9.10 | vulnerable |
| Ubuntu | python-apt | pro | 2.0.0 | vulnerable |
| Ubuntu | python-apt | pro | 2.0.0ubuntu0.20.04.1 | vulnerable |
| Ubuntu | python-apt | pro | 2.0.0ubuntu0.20.04.2 | vulnerable |
| Ubuntu | python-apt | pro | 2.0.0ubuntu0.20.04.3 | vulnerable |
| Ubuntu | python-apt | pro | 2.0.0ubuntu0.20.04.4 | vulnerable |
| Ubuntu | python-apt | pro | 2.0.0ubuntu0.20.04.5 | vulnerable |
| Ubuntu | python-apt | pro | 2.0.0ubuntu0.20.04.6 | vulnerable |
| Ubuntu | python-apt | pro | 2.0.0ubuntu0.20.04.7 | vulnerable |
| Ubuntu | python-apt | pro | 2.0.0ubuntu0.20.04.8 | vulnerable |
| Ubuntu | python-apt | pro | 2.0.1 | vulnerable |
| Ubuntu | python-apt | pro | 2.0.1ubuntu0.20.04.1 | vulnerable |
| Ubuntu | python-apt | pro | 2.0.1ubuntu0.20.04.1+esm1 | fixed |
| Ubuntu | python-apt | 22.04 | 2.2.1 | vulnerable |
| Ubuntu | python-apt | 22.04 | 2.3.0 | vulnerable |
| Ubuntu | python-apt | 22.04 | 2.3.0ubuntu1 | vulnerable |
| Ubuntu | python-apt | 22.04 | 2.3.0ubuntu2 | vulnerable |
| Ubuntu | python-apt | 22.04 | 2.3.0ubuntu2.1 | vulnerable |
| Ubuntu | python-apt | 22.04 | 2.4.0 | vulnerable |
| Ubuntu | python-apt | 22.04 | 2.4.0ubuntu1 | vulnerable |
| Ubuntu | python-apt | 22.04 | 2.4.0ubuntu2 | vulnerable |
| Ubuntu | python-apt | 22.04 | 2.4.0ubuntu3 | vulnerable |
| Ubuntu | python-apt | 22.04 | 2.4.0ubuntu4 | vulnerable |
| Ubuntu | python-apt | 22.04 | 2.4.0ubuntu4.1 | fixed |
| Ubuntu | python-apt | 24.04 | 2.6.0ubuntu1 | vulnerable |
| Ubuntu | python-apt | 24.04 | 2.6.0ubuntu2 | vulnerable |
| Ubuntu | python-apt | 24.04 | 2.7.0 | vulnerable |
| Ubuntu | python-apt | 24.04 | 2.7.5 | vulnerable |
| Ubuntu | python-apt | 24.04 | 2.7.6 | vulnerable |
| Ubuntu | python-apt | 24.04 | 2.7.7 | vulnerable |
| Ubuntu | python-apt | 24.04 | 2.7.7build1 | vulnerable |
| Ubuntu | python-apt | 24.04 | 2.7.7ubuntu1 | vulnerable |
| Ubuntu | python-apt | 24.04 | 2.7.7ubuntu2 | vulnerable |
| Ubuntu | python-apt | 24.04 | 2.7.7ubuntu3 | vulnerable |
| Ubuntu | python-apt | 24.04 | 2.7.7ubuntu4 | vulnerable |
| Ubuntu | python-apt | 24.04 | 2.7.7ubuntu5 | vulnerable |
| Ubuntu | python-apt | 24.04 | 2.7.7ubuntu5.1 | fixed |
| Ubuntu | python-apt | 25.10 | 3.0.0 | vulnerable |
| Ubuntu | python-apt | 25.10 | 3.0.0ubuntu1 | vulnerable |
| Ubuntu | python-apt | 25.10 | 3.0.0ubuntu1.1 | fixed |
| Ubuntu | python-apt | pro | 1.9.0ubuntu1 | vulnerable |
| Ubuntu | python-apt | pro | 1.9.0ubuntu3 | vulnerable |
| Ubuntu | python-apt | pro | 1.9.0ubuntu5 | vulnerable |
| Ubuntu | python-apt | pro | 1.9.3ubuntu2 | vulnerable |
| Ubuntu | python-apt | pro | 1.9.5 | vulnerable |
| Ubuntu | python-apt | pro | 1.9.5build1 | vulnerable |
| Ubuntu | python-apt | pro | 1.9.7 | vulnerable |
| Ubuntu | python-apt | pro | 1.9.8 | vulnerable |
| Ubuntu | python-apt | pro | 1.9.10 | vulnerable |
| Ubuntu | python-apt | pro | 2.0.0 | vulnerable |
| Ubuntu | python-apt | pro | 2.0.0ubuntu0.20.04.1 | vulnerable |
| Ubuntu | python-apt | pro | 2.0.0ubuntu0.20.04.2 | vulnerable |
| Ubuntu | python-apt | pro | 2.0.0ubuntu0.20.04.3 | vulnerable |
| Ubuntu | python-apt | pro | 2.0.0ubuntu0.20.04.4 | vulnerable |
| Ubuntu | python-apt | pro | 2.0.0ubuntu0.20.04.5 | vulnerable |
| Ubuntu | python-apt | pro | 2.0.0ubuntu0.20.04.6 | vulnerable |
| Ubuntu | python-apt | pro | 2.0.0ubuntu0.20.04.7 | vulnerable |
| Ubuntu | python-apt | pro | 2.0.0ubuntu0.20.04.8 | vulnerable |
| Ubuntu | python-apt | pro | 2.0.1 | vulnerable |
| Ubuntu | python-apt | pro | 2.0.1ubuntu0.20.04.1 | vulnerable |
| Ubuntu | python-apt | pro | 2.0.1ubuntu0.20.04.1+esm1 | vulnerable |
| Ubuntu | python-apt | pro | 2.0.1ubuntu0.20.04.2esm2 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | python-apt | source | sid | 3.1.0 | not yet assigned | Not reported | [1122291] |
| Debian | python-apt | source | forky | 3.1.0 | not yet assigned | Not reported | [1122291] |
| Debian | python-apt | source | trixie | (unfixed) | not yet assigned | Not reported | [1122291] |
| Debian | python-apt | source | bookworm | (unfixed) | not yet assigned | Not reported | [1122291] |
| Ubuntu | python-apt | deb | noble | 2.7.7ubuntu5.1 | Not reported | Not reported | Not reported |
| Ubuntu | python-apt-common | deb | noble | 2.7.7ubuntu5.1 | Not reported | Not reported | Not reported |
| Ubuntu | python-apt-dev | deb | noble | 2.7.7ubuntu5.1 | Not reported | Not reported | Not reported |
| Ubuntu | python-apt-doc | deb | noble | 2.7.7ubuntu5.1 | Not reported | Not reported | Not reported |
| Ubuntu | python3-apt | deb | noble | 2.7.7ubuntu5.1 | Not reported | Not reported | Not reported |
| Ubuntu | python-apt | deb | pro | 2.0.1ubuntu0.20.04.1+esm1 | Not reported | USN-7916-1 | Not reported |
| Ubuntu | python-apt | deb | 22.04 | 2.4.0ubuntu4.1 | Not reported | USN-7916-1 | Not reported |
| Ubuntu | python-apt | deb | 24.04 | 2.7.7ubuntu5.1 | Not reported | USN-7916-1 | Not reported |
| Ubuntu | python-apt | deb | 25.10 | 3.0.0ubuntu1.1 | Not reported | USN-7916-1 | Not reported |
| Ubuntu | python-apt | deb | pro | 2.0.1ubuntu0.20.04.1+esm1 | Not reported | UBUNTU-CVE-2025-6966 | Not reported |
| Ubuntu | python-apt | deb | 22.04 | 2.4.0ubuntu4.1 | Not reported | UBUNTU-CVE-2025-6966 | Not reported |
| Ubuntu | python-apt | deb | 24.04 | 2.7.7ubuntu5.1 | Not reported | UBUNTU-CVE-2025-6966 | Not reported |
| Ubuntu | python-apt | deb | 25.10 | 3.0.0ubuntu1.1 | Not reported | UBUNTU-CVE-2025-6966 | Not reported |
| Ubuntu | python-apt | deb | pro | 2.0.1ubuntu0.20.04.2esm2 | Not reported | USN-7916-2 | Not reported |
Notes
[trixie] python-apt: Minor issue [bookworm] python-apt: Minor issue
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [python3-apt]Affected
Source package: [python-apt]
Details (2)
2.6.0· amd64 · bookwormAffected
usn · python-apt · debian · bookworm; usn · python-apt · debian · 12
2.6.0· arm64 · bookwormAffected
usn · python-apt · debian · bookworm; usn · python-apt · debian · 12
- [python-apt-common]Affected
Source package: [python-apt]
Details (2)
2.6.0· all · bookwormAffected
usn · python-apt · debian · bookworm; usn · python-apt · debian · 12
2.6.0· all · bookwormAffected
usn · python-apt · debian · bookworm; usn · python-apt · debian · 12
- [python-apt-dev]Affected
Source package: [python-apt]
Details (2)
2.6.0· all · bookwormAffected
usn · python-apt · debian · bookworm; usn · python-apt · debian · 12
2.6.0· all · bookwormAffected
usn · python-apt · debian · bookworm; usn · python-apt · debian · 12
- [python-apt-doc]Affected
Source package: [python-apt]
Details (2)
2.6.0· all · bookwormAffected
usn · python-apt · debian · bookworm; usn · python-apt · debian · 12
2.6.0· all · bookwormAffected
usn · python-apt · debian · bookworm; usn · python-apt · debian · 12
[Debian 13 (Trixie)]
- [python3-apt]Affected
Source package: [python-apt]
Details (2)
3.0.0· amd64 · trixieAffected
usn · python-apt · debian · 13
3.0.0· arm64 · trixieAffected
usn · python-apt · debian · 13
- [python-apt-common]Affected
Source package: [python-apt]
Details (2)
3.0.0· all · trixieAffected
usn · python-apt · debian · 13
3.0.0· all · trixieAffected
usn · python-apt · debian · 13
- [python-apt-dev]Affected
Source package: [python-apt]
Details (2)
3.0.0· all · trixieAffected
usn · python-apt · debian · 13
3.0.0· all · trixieAffected
usn · python-apt · debian · 13
- [python-apt-doc]Affected
Source package: [python-apt]
Details (2)
3.0.0· all · trixieAffected
usn · python-apt · debian · 13
3.0.0· all · trixieAffected
usn · python-apt · debian · 13
Observed:
References
- [https://nvd.nist.gov/vuln/detail/CVE-2025-6966]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2025-6966]
- [https://osv.dev/vulnerability/DLA-4408-1]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2025-6966]
- [https://osv.dev/vulnerability/USN-7916-1]
- [https://osv.dev/vulnerability/USN-7916-2]
- [https://security-tracker.debian.org/tracker/CVE-2025-6966]
- [https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-6966.json]
- [https://ubuntu.com/security/notices/USN-7916-1]
[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [Ubuntu Security Notices (USN)]