Radicale Vulnerability — Ubuntu Security Update (USN-9084-1)
USN-9084-1 updates Ubuntu 20.04, Ubuntu 22.04: It was discovered that Radicale did not delay failed authentication attempts when using htpasswd authentication. Apply the update via standard apt tooling.
What this means under a SharedLicense license
The advisory's own severity data peaks at CVSS 8.1 (CWE-362); unpatched Ubuntu 20.04, Ubuntu 22.04 servers remain exposed until updated.
-
USN-9084-1
Publication date
12 November 2026
Overview
Radicale could be made to expose sensitive information over the network.
Releases
Packages
- radicale – simple calendar and addressbook server
Details
It was discovered that Radicale did not delay failed authentication
attempts when using htpasswd authentication. A remote attacker could
possibly use this issue to obtain user passwords through timing or
brute-force attacks.
It was discovered that Radicale did not delay failed authentication
attempts when using htpasswd authentication. A remote attacker could
possibly use this issue to obtain user passwords through timing or
brute-force attacks.
Update instructions
After a standard system update you need to restart Radicale to make all the
necessary changes.
Learn more about how to get the fixes.
The problem can be corrected by updating your system to the following package versions:
| Ubuntu Release | Package Version | ||
|---|---|---|---|
| 16.04 LTS xenial | python-radicale – 1.1.1-1ubuntu0.1~esm1 | ||
| python3-radicale – 1.1.1-1ubuntu0.1~esm1 | |||
| radicale – 1.1.1-1ubuntu0.1~esm1 | |||
References
Frequently Asked Questions
What does USN-9084-1 fix?
Which Ubuntu releases are covered?
How do I apply it?
Check your system for vulnerabilities
Select your product and operating system to see the exact fix commands that apply to you.
Check Your System