USN-8976-1: Ubuntu patches HTTP response splitting flaw in apt-cacher from 2017

Canonical published security advisory USN-8976-1 on 3 November 2026, closing an HTTP response splitting vulnerability in apt-cacher. It affects those still running Ubuntu 16.04 LTS (xenial) in production under Extended Security Maintenance with apt-cacher active as a cache proxy for Debian/Ubuntu repositories.

The vulnerability

In the advisory, Canonical explains that apt-cacher was found to incorrectly handle newline characters encoded in requests. As a result, a remote attacker could potentially exploit this issue to perform HTTP response splitting attacks.

The flaw is identified as CVE-2017-7443. According to Ubuntu's official CVE record, apt-cacher versions before 1.7.15 and apt-cacher-ng before 3.4 permit HTTP response splitting via encoded newline characters, related to improper handling of the %0[ad] regular expression. The OSV bulletin classifies the severity at 6.1 on the CVSS 3.0 scale, a medium level.

This is not a recent discovery: the Debian changelog shows that the upstream fix for apt-cacher dates back to 21 March 2017, with the note: Prevent HTTP response splitting with encoded newlines in request. -- Mark Hindley Tue, 21 Mar 2017 09:52:04 +0000. Nearly ten years later, Ubuntu has brought the same fix to the ESM branch of xenial, underscoring how long patches can remain in queue for less frequently maintained packages in long-term maintenance repositories.

What to do

The only affected release is 16.04 LTS. The corrected package version is listed in the advisory: 16.04 LTS xenial apt-cacher – 1.7.11ubuntu0.16.04.1~esm1.

After updating, the service does not restart automatically: Canonical reminds that following a standard system update, you must restart Apt-Cacher to make all necessary changes effective. On xenial the command remains sudo apt update && sudo apt upgrade apt-cacher followed by sudo systemctl restart apt-cacher.

It should be noted that access to this package on 16.04 requires an Ubuntu Pro subscription, as the release has been out of standard support since 2021 and only follows the ESM cycle.