CVE-2026-109518
published 2026-11-04CVE-2026-109518: On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between…
PriorityP356high7.7CVSS 4.0
AVNACLATPPRNUIPVCHVIHVAHSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.93%
60.8th percentile
On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges.
The vulnerability is caused by the reuse of hard links and requires the client to follow redirects and retry the download of package files. It requires the client to have a non-zero Acquire::Retries configuration setting; the value 3 is the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older releases are unaffected in a default configuration
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | apt | < 1.2.36 | 1.2.36 |
| debian | apt | — | — |
| debian | apt | >= 1.4.0 < 1.4.12 | 1.4.12 |
| debian | apt | >= 1.6.0 < 1.6.19 | 1.6.19 |
| debian | apt | >= 1.8.0 < 1.8.2.4 | 1.8.2.4 |
| debian | apt | 1.8.3 – 1.8.5 | — |
| debian | apt | >= 2.0.0 < 2.0.12 | 2.0.12 |
| debian | apt | >= 2.2.0 < 2.2.5 | 2.2.5 |
| debian | apt | >= 2.4.0 < 2.4.15 | 2.4.15 |
| debian | apt | >= 2.6.0 < 2.6.2 | 2.6.2 |
| debian | apt | >= 2.8.0 < 2.8.4 | 2.8.4 |
| debian | apt | >= 3.0.0 < 3.0.4 | 3.0.4 |
| debian | apt | >= 3.2.0 < 3.2.1 | 3.2.1 |
| debian | apt | >= 3.3.0 < 3.3.6 | 3.3.6 |
| ubuntu | apt | < 1.0.1ubuntu2.24+esm4 | 1.0.1ubuntu2.24+esm4 |
| ubuntu | apt | >= 1.2.0 < 1.2.36+esm1 | 1.2.36+esm1 |
| ubuntu | apt | >= 1.6.0 < 1.6.19+esm1 | 1.6.19+esm1 |
| ubuntu | apt | >= 2.0.0 < 2.0.12+esm1 | 2.0.12+esm1 |
| ubuntu | apt | >= 2.4.0 < 2.4.15ubuntu0.1 | 2.4.15ubuntu0.1 |
| ubuntu | apt | >= 2.8.0 < 2.8.4ubuntu0.1 | 2.8.4ubuntu0.1 |
| ubuntu | apt | >= 3.2.0 < 3.2.1ubuntu0.1 | 3.2.1ubuntu0.1 |
| ubuntu | apt | >= 3.3.0 < 3.3.3ubuntu0.1 | 3.3.3ubuntu0.1 |
CVSS provenance
nvdv4.07.7HIGHCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat7.7HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
apt: apt: Remote code execution via hard link reuse during package download retries
vendor_redhat·2026-11-04·CVSS 7.7
CVE-2026-109518 [HIGH] CWE-494 apt: apt: Remote code execution via hard link reuse during package download retries
apt: apt: Remote code execution via hard link reuse during package download retries
On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges.
The vulnerability is caused by the reuse of hard links and requires the client to follow redirects and retry the download of package files. It requires the client to have a non-zero Acquire::Retries configuration setting; the value 3 is the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older releases are unaffect
GHSA
On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server trigg
ghsa_unreviewed·2026-11-04
CVE-2026-109518 [HIGH] CWE-62 On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server trigg
On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges.
The vulnerability is caused by the reuse of hard links and requires the client to follow redirects and retry the download of package files. It requires the client to have a non-zero Acquire::Retries configuration setting; the value 3 is the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older releases are unaffected in a default configuration
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-109518 apt: apt: Remote code execution via hard link reuse during package download retries
bugzilla·2026-11-05·CVSS 7.7
CVE-2026-109518 [HIGH] CVE-2026-109518 apt: apt: Remote code execution via hard link reuse during package download retries
CVE-2026-109518 apt: apt: Remote code execution via hard link reuse during package download retries
On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges.
The vulnerability is caused by the reuse of hard links and requires the client to follow redirects and retry the download of package files. It requires the client to have a non-zero Acquire::Retries configuration setting; the value 3 is the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older rel
Hackernews
Debian and Ubuntu APT Flaw Lets MitM Attackers Swap Verified Packages and Run Code as Root
blogs_hackernews·2026-11-04·CVSS 7.7
CVE-2026-109518 [HIGH] Debian and Ubuntu APT Flaw Lets MitM Attackers Swap Verified Packages and Run Code as Root
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Debian and Ubuntu APT Flaw Lets MitM Attackers Swap Verified Packages and Run Code as Root
A flaw in APT , the package manager for Debian and Ubuntu, allows an attacker who can modify package downloads to swap a checked package for their own.
The attacker's code then runs as root, according to advisories that Debian , Ubuntu , and APT's developers published on November 4. The attack needs APT to retry failed downloads, which it does by default from Debian 12 and Ubuntu 22.04 onward.
Debian has released fixed versions of APT for the flaw, CVE-2026-109518 . APT's developers, who call the flaw critical, say updates for Ubuntu
2026-11-04
Published