---
title: "HOST-OS-001 Operating System Past End of Security Support"
canonical: https://openvapt.com/checks/HOST-OS-001.html
html: https://openvapt.com/checks/HOST-OS-001.html
site: OpenVAPT, https://openvapt.com/
license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html
modified: 2026-10-14
version: 0.1.0-alpha.6
---

# HOST-OS-001 Operating System Past End of Security Support

Checks whether the Linux distribution release still receives free security updates.

- Domain: Server
- Severity: High
- Control category: Patch and Vulnerability Management
- Fix effort: high
- CVSS v3.1 vector: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H`
- CIS Controls v8: 2.2
- NIST CSF 2.0: ID.RA-01, PR.PS-02
- CWE: CWE-1104
- OWASP Top 10 2021: A06:2021
- NIST SP 800-53 Rev. 5: SA-22, SI-2
- Benchmark topic: Supported operating system versions (topic only, no benchmark text)

## Why It Matters

Once a release reaches end of life, newly discovered vulnerabilities are never fixed. Every later CVE in the kernel, OpenSSL or the web server stays open forever.

## How It Detects

Reads ID and VERSION_ID from /etc/os-release and looks them up in a dated table of free vendor security-support dates, including Debian LTS (table date 2026-10-13). Releases older than the oldest table row for their distribution fail. Releases within 90 days of end of life also fail, so there is time to plan the upgrade.

## How to Fix

Plan an upgrade to a supported release (for example do-release-upgrade on Ubuntu, or a fresh install and migration). Paid extended support (Ubuntu Pro, RHEL ELS) is an alternative while migrating.

## How to Verify

```
cat /etc/os-release  and compare with the vendor lifecycle page.
```

## Learn the Theory

- [F3 Vulnerabilities, CVE, CWE and CVSS](https://openvapt.com/academy/f3.md)
- [P1 Linux Server Hardening](https://openvapt.com/academy/p1.md)

## References

- [Ubuntu release cycle](https://ubuntu.com/about/release-cycle)
- [Debian releases and LTS](https://wiki.debian.org/LTS)
- [Red Hat Enterprise Linux life cycle](https://access.redhat.com/support/policy/updates/errata)
- [endoflife.date (community-maintained lifecycle data)](https://endoflife.date/)

## Source Code

https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/os_patch.go

Run it: `openvapt scan --only HOST-OS-001`. Read it offline: `openvapt explain HOST-OS-001`.

---

OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/checks/HOST-OS-001.html. Part of OpenVAPT Check Catalogue. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.