According to Ubuntu, the free five year security commitment covers Main packages, maintained by Canonical without a subscription. Universe holds more than 36,000 packages per release, and its security coverage for ten years comes through the esm-apps stream in Ubuntu Pro. Check which repository each of your packages comes from.
Two repositories, two promises
Ubuntu organises packages into repositories. Main is the core set. Universe is a much larger community set. The ESM page states that Universe contains over 36,000 packages per release (as of Ubuntu 24.04 LTS), and that the esm-apps stream of Ubuntu Pro covers all Universe packages for ten years from the LTS release. It also says the free five year commitment covers Main only.
| Repository | Free window | Extended coverage |
|---|---|---|
| Main | Five years, no subscription | Not covered here, see Ubuntu documentation |
| Universe | Not part of the free commitment | Ten years through esm-apps with Ubuntu Pro |
The ESM page lists Universe end dates by release, including May 2039 for 24.04 LTS and May 2035 for 20.04 LTS. Note that the page's own wording of "ten years from the release" and its table dates differ, so read the table for your release and confirm against current Ubuntu documentation before you build a plan on a specific date.
Why developers should care
Developers install what is convenient. A language runtime, an image library, a tool pulled in through apt: any of these may come from Universe. If your server or base image is an LTS release and you never check the repository, you may assume a fix will arrive when it is not part of your coverage.
How to see where a package comes from
apt policy package-name
The output shows the archive component the installed version came from. Look for main or universe in the origin line.
Decision guide
- List the packages that matter to your service: the runtime, the TLS library, anything that parses untrusted input.
- Check each one's repository component.
- For Universe packages on a host you operate, decide whether to use the extended stream, move to a package you manage yourself, or replace it with a pinned upstream build you track.
- For container base images, the same question applies. See how to check if your base image operating system is end of life and is Ubuntu 20.04 end of life.
- Write down which packages sit outside free coverage and put them in your exception register.
What a scanner can and cannot say
A scanner may report an unfixed vulnerability in a package. Whether a fix exists in the extended stream is a distribution question that the scanner may not know about. Read the distribution's own advisory before concluding that no fix exists. Why a Linux distro rates a CVE differently than CVSS covers the related point.
Quick check
Is Universe covered by the free five year commitment?
Ubuntu's ESM page says the free commitment covers Main packages only.
How do I know whether a package is in Main or Universe?
Run apt policy on the package and read the archive component in the output.
Safeguard's SBOM and dependency scanning lists the OS packages in your images and hosts, which makes the Main versus Universe question easier to answer. Try a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
