Ubuntu tracks each CVE per package and per release with a status such as needs evaluation, not affected, vulnerable, fix deferred, fixed or ignored. In a container scan on an Ubuntu base, that status explains why a finding has no fixed version and what, if anything, the vendor plans to do.
The statuses, as Canonical defines them
Canonical's documentation lists these:
| Status | Meaning from the docs | What it means for your image |
|---|---|---|
| Needs evaluation | Not yet known whether the package is affected for that release | Treat as unknown, watch for an update |
| Not affected | Related to the CVE but not affected for that release | Safe to close the finding with a note |
| Vulnerable | Affected | Open, fix not yet published |
| Vulnerable, work in progress | Affected, security team working on a fix | Open, expect a fix |
| Vulnerable, fix deferred | Affected, fixing deferred, usually with an explanation | Open, decide your own control |
| Fixed | A fixed version is available, usually with the version number | Update to that version |
| Ignored | Won't be fixed, for example unsupported package, withdrawn CVE, or the fix would break functionality | No fix is coming |
| Not in release | Package is not part of the release | Finding is likely a mismatch |
The docs add that the summary shown in CVE search aggregates every package and release, and recommend checking the individual page for your release.
Why this matters for scans
A scanner that just prints severity hides the status. Two High findings can need opposite handling: one is fixed and waiting in an update, the other is ignored by the vendor and will never be patched. Ask your scanner to show the vendor status next to the finding, or look it up by CVE.
Also read the notes. Canonical says it usually explains deferred and ignored decisions there, and that explanation is often strong evidence for an exception.
Acting on each status
- Fixed: rebuild with a fresh pull and apt refresh, then confirm. See confirming a fix landed.
- Not affected or not in release: close with the vendor note attached.
- Needs evaluation, work in progress: set a re-check date.
- Fix deferred or ignored: assess reachability, add controls, write an exception with an expiry. See suppress with expiry and VEX.
- If the finding stays high risk and ignored, plan a move to a base that still receives updates.
Support windows and the base
Ubuntu's security page says LTS releases get five years of standard security updates for packages in Main, with more coverage available through a paid subscription. A base image on a release past its standard window may therefore show more findings that never get a fixed version. Check the release's status, as covered in is your base image end of life.
Priority is not status
Ubuntu also assigns a priority to each CVE. Priority is about severity as Ubuntu rates it, status is about the fix. They answer different questions. For priority, read Ubuntu priority levels versus CVSS.
Quick check
Does ignored mean the CVE is harmless?
No. It means Ubuntu will not ship a fix, for reasons given in the notes. You still own the risk in your image.
Do other distributions use the same words?
Not exactly. Debian uses its own states, covered in the Debian tracker post. Read each vendor's definitions.
Sources
Last reviewed: 19 October 2026.
