This page tracks the Ubuntu fix status. The vulnerability itself is described on the main CVE page.
View CVE-2026-109399 →
UBUNTU-CVE-2026-109399
SWUpdate through 2026.05.1 contains an improper certificate validation vulnerability in crypto/swupdate_cms_verify_openssl.c that trusts untrusted X.5...
Original description
The description as published by the source.
SWUpdate through 2026.05.1 contains an improper certificate validation vulnerability in crypto/swupdate_cms_verify_openssl.c that trusts untrusted X.509 certificates embedded in CMS SignedData for chain building. Attackers holding a signing key from a sibling intermediate under the same root can embed that intermediate in the signature to install malicious updates.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Ubuntu:22.04:LTS
swupdate
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:24.04:LTS
swupdate
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:26.10
swupdate
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:26.04:LTS
swupdate
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
References
- report ubuntu.com
- report cve.org
- report github.com
- report github.com
- report github.com
- report groups.google.com
- report vulncheck.com