---
name: canonical-ubuntu-security-cve-lookup
description: >-
  Answer "is this Ubuntu release or package affected by this CVE, and is there a fix?" using the open,
  unauthenticated Ubuntu Security API.
api: canonical:ubuntu-security-api
spec: openapi/canonical-ubuntu-security-api-openapi.json
operations:
  - 'GET /security/cves.json'
  - 'GET /security/cves/{cve_id}.json'
  - 'GET /security/notices.json'
  - 'GET /security/notices/{notice_id}.json'
  - 'GET /security/releases.json'
  - 'GET /security/releases/{release_codename}.json'
generated: '2026-09-05'
method: none
source: 'derived from openapi/canonical-ubuntu-security-api-openapi.json, harvested verbatim from https://ubuntu.com/security/api/spec.json'
---

# Look up Ubuntu CVEs and security notices

The Ubuntu Security API is the most agent-friendly thing Canonical publishes: it is open, needs no
credential, is read-only, and answers a question that comes up constantly. Base host is
`https://ubuntu.com`; the contract is Swagger 2.0 at `https://ubuntu.com/security/api/spec.json`.

Verified live on 2026-09-05: `GET https://ubuntu.com/security/releases.json` returns 200 with no
credential of any kind.

## 1. Know which releases exist and which are still supported

`GET /security/releases.json` — every Ubuntu release with its codename and support status.
`GET /security/releases/{release_codename}.json` for one (e.g. `noble`, `jammy`).

Support status matters before you interpret anything else: a release that is out of standard support
may show "no fix" simply because fixes moved behind Ubuntu Pro ESM.

## 2. Look up a CVE

`GET /security/cves/{cve_id}.json` — e.g. `/security/cves/CVE-2024-3094.json`.

The `CVEAPI` schema returns `description`, `cvss3`, `codename`, `bugs[]`, per-package status, and the
notices that address it. Read the per-release/per-package status rather than the top-level summary:
"fixed" is always relative to a release.

## 3. Search CVEs

`GET /security/cves.json` with filters (package, release, priority, status) and `offset`/`limit`
paging. This is offset/limit paging, not a cursor.

## 4. Read the notices

`GET /security/notices.json` and `GET /security/notices/{notice_id}.json` — Ubuntu Security Notices
(USN-xxxx-y). A USN is the thing that actually ships the fix, so the notice tells you which package
version resolves the CVE on which release.

## Two traps the API itself documents

1. **The notices endpoints were flattened deliberately.** Canonical's own docs page carries a warning:
   the nesting of `notices` endpoints was reduced "due to an increase in the size of the payloads that
   compromised the availability of the service". Each notice now carries CVE **ids** only; getting CVE
   detail needs a second request. The old shapes are preserved at `/security/compat/notices.json` and
   `/security/compat/notices/{notice_id}.json`, and Canonical warns those "will likely not see many
   improvements". Do not build on the compat paths.
2. **A 413 means your query was too broad**, not that the service is down. Narrow the filter and page.

## Pacing

There are no published rate limits and no `RateLimit-*` headers — measured, not assumed. What the
responses do carry is `cache-control: max-age=60, stale-while-revalidate=86400, stale-if-error=300`.
Treat 60 seconds as the refresh floor: polling faster returns the same cached body.