How to fix W: Failed to fetch URL Hash Sum mismatch in APT

APTINTERMEDIATEMEDIUMUpdated Dec 29, 2025· 310 views

APT fails to download or verify package metadata with a 'Hash Sum mismatch' error. This occurs when the checksum computed by APT does not match the expected value, usually due to corrupted downloads or metadata cache issues.

Quick fix

Fixes W: Failed to fetch URL Hash Sum mismatch

sudo rm /var/lib/apt/lists/* -vf
sudo apt-get update
  1. Clear the APT cache and lists
  2. Force gzip compression instead of lzma
  3. Switch to a different repository mirror
  4. Upgrade APT to the latest version
apt — error
sudo rm /var/lib/apt/lists/* -vf
sudo apt-get update
W: Failed to fetch URL Hash Sum mismatch

What this error means

The 'Hash Sum mismatch' error indicates that APT has downloaded package metadata but the computed checksum does not match the value listed in the repository's top-level metadata file. This is a data integrity check that prevents installation of potentially corrupted packages. The error can occur due to a bug in APT's lzma decompression, incomplete downloads from network issues, mirror synchronization problems, or corrupted local cache files.

Typical symptoms

  • apt update fails with 'W: Failed to fetch' followed by 'Hash Sum mismatch'
  • Package installation is blocked until the issue is resolved
  • The error occurs consistently or intermittently when updating
  • Only specific packages or mirrors show the mismatch error

Common causes

  1. Corrupted APT cache files in /var/lib/apt/lists/
  2. A bug in APT's lzma (.xz) file decompression causing metadata corruption
  3. Incomplete downloads due to network interruptions or slow connections
  4. Repository mirror currently synchronizing, serving incomplete files
  5. Running an outdated version of APT with known lzma decompression issues

How to fix "W: Failed to fetch URL Hash Sum mismatch"

1Clear the APT cache and lists

The most common solution is to remove all cached repository metadata and let APT re-download it:

bash
sudo rm /var/lib/apt/lists/* -vf
sudo apt-get update

This removes corrupted metadata files and forces APT to fetch fresh copies from the repository.

2Force gzip compression instead of lzma

As a temporary workaround, configure APT to use gzip compression instead of lzma, which avoids the decompression bug:

bash
sudo apt-get update -o Acquire::CompressionTypes::Order::=gz

For a permanent fix, create a configuration file:

bash
sudo nano /etc/apt/apt.conf.d/99compression-workaround

Add this line:

bash
Acquire::CompressionTypes::Order:: "gz";

Save and exit. Now apt-get update will prefer gzip compression.

3Switch to a different repository mirror

If the error persists with the default mirror, try switching to an official mirror that may be fresher:

bash
sudo nano /etc/apt/sources.list

Change the mirror URL. For example, on Ubuntu, you can use a different CDN mirror. Then run:

bash
sudo apt-get update

If a specific mirror is syncing, using an alternative mirror can resolve the issue immediately.

4Upgrade APT to the latest version

For systems running Ubuntu 14.04 or Debian 8 and newer, upgrade APT to get the lzma decompression fix:

bash
sudo apt-get install --only-upgrade apt

The bug was fixed in APT version 1.0 and later. After upgrading, run:

bash
sudo apt-get update
5Verify your network connection

If the downloaded file size is significantly smaller than expected, your network connection may be the issue:

- Check your internet speed: speedtest-cli or similar tools
- Verify connectivity: ping 8.8.8.8
- Restart your modem and router
- Try again with a more stable connection

A stable, fast connection helps ensure metadata files are downloaded completely and correctly.

Advanced notes

The core cause of this error is a known bug in APT's lzma decompression code. When APT downloads compressed metadata files (.xz format), the decompression can occasionally corrupt the file, resulting in a checksum mismatch. This bug was fixed in APT 1.0 and later. For systems running older APT versions (very rare now), upgrading APT is the permanent solution. Modern systems running Ubuntu 16.04+, Debian 9+, or similar will have APT 1.2.0+, which includes the Acquire-by-hash feature that further prevents race conditions during mirror syncs. If you're experiencing this on a modern system, cache corruption is the most likely cause, and clearing the lists directory resolves it in 95% of cases.

Frequently asked questions

What does "W: Failed to fetch URL Hash Sum mismatch" mean?
The 'Hash Sum mismatch' error indicates that APT has downloaded package metadata but the computed checksum does not match the value listed in the repository's top-level metadata file. This is a data integrity check that prevents installation of potentially corrupted packages. The error can occur due to a bug in APT's lzma decompression, incomplete downloads from network issues, mirror synchronization problems, or corrupted local cache files.
How do I fix "W: Failed to fetch URL Hash Sum mismatch"?
APT fails to download or verify package metadata with a 'Hash Sum mismatch' error. This occurs when the checksum computed by APT does not match the expected value, usually due to corrupted downloads or metadata cache issues.
What causes "W: Failed to fetch URL Hash Sum mismatch"?
Corrupted APT cache files in /var/lib/apt/lists/ A bug in APT's lzma (.xz) file decompression causing metadata corruption Incomplete downloads due to network interruptions or slow connections
Is the "W: Failed to fetch URL Hash Sum mismatch" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading