Skip to content
OpenAdvisories
High USN-8996-1 1 CVE

apt vulnerability

Published Nov 4, 2026 · Updated Nov 5, 2026

Ecosystem: Ubuntu

Summary

Max Justicz discovered that APT incorrectly handled hard links when
encountering redirects and retrying package downloads. A remote on-path
attacker could possibly use this issue to trick APT into installing an
unverified package and achieve remote code execution with root privileges.

Fixed packages 8

ReleasePackageFixed in
Ubuntu · 22.04 LTS 22.04:LTS apt 2.4.15ubuntu0.1
Ubuntu · 24.04 LTS 24.04:LTS apt 2.8.4ubuntu0.1
Ubuntu · 26.04 LTS 26.04:LTS apt 3.2.1ubuntu0.1
Ubuntu · 26.10 apt 3.3.3ubuntu0.1
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS apt 1.0.1ubuntu2.24+esm4
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS apt 1.2.36+esm1
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS apt 1.6.19+esm1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS apt 2.0.12+esm1

Vulnerabilities 1

  • High 7.7
    CVE-2026-109518 Public exploit

    APT RCE via hard link reuse

    On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into install…

    Ubuntu Debian APT APT Debian Ubuntu Alpine

References

  • report
    https://ubuntu.com/security/CVE-2026-109518