Description
On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges.
The vulnerability is caused by the reuse of hard links and requires the client to follow redirects and retry the download of package files. It requires the client to have a non-zero Acquire::Retries configuration setting; the value 3 is the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older releases are unaffected in a default configuration
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Debian | APT | < 1.2.36, 1.4.0 – < 1.4.12, 1.6.0 – < 1.6.19, 1.8.0 – < 1.8.2.4, 1.8.3 – ≤ 1.8.5, 2.0.0 – < 2.0.12, 2.2.0 – < 2.2.5, 2.4.0 – < 2.4.15, 2.6.0 – < 2.6.2, 2.8.0 – < 2.8.4, 3.0.0 – < 3.0.4, 3.2.0 – < 3.2.1, 3.3.0 – < 3.3.6 | 1.2.36 |
| Ubuntu | APT | < 1.0.1ubuntu2.24+esm4, 1.2.0 – < 1.2.36+esm1, 1.6.0 – < 1.6.19+esm1, 2.0.0 – < 2.0.12+esm1, 2.4.0 – < 2.4.15ubuntu0.1, 2.8.0 – < 2.8.4ubuntu0.1, 3.2.0 – < 3.2.1ubuntu0.1, 3.3.0 – < 3.3.3ubuntu0.1 | 1.0.1ubuntu2.24+esm4 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | apt | 3.3.6 | — |
| Debian 13 | apt | 3.0.4 | — |
| Debian 12 | apt | 2.6.2 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | apt | 3.3.3ubuntu0.1 | USN-8996-1 |
| Ubuntu 26.04 LTS | apt | 3.2.1ubuntu0.1 | USN-8996-1 |
| Ubuntu 24.04 LTS | apt | 2.8.4ubuntu0.1 | USN-8996-1 |
| Ubuntu 22.04 LTS | apt | 2.4.15ubuntu0.1 | USN-8996-1 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | apt | 2.0.12+esm1 | USN-8996-1 |
| Ubuntu Pro 18.04 LTS | apt | 1.6.19+esm1 | USN-8996-1 |
| Ubuntu Pro 16.04 LTS | apt | 1.2.36+esm1 | USN-8996-1 |
| Ubuntu Pro 14.04 LTS | apt | 1.0.1ubuntu2.24+esm4 | USN-8996-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | apt | 3.2.1-r0 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 2 repositories
-
jordanhardee/cve-2026-109518-apt-patch-proxmox-and-generic ★ 2 · Nov 5, 2026
Silly little patch for cve-2026-109518 for apt targeting generic linux and Proxmox host, VM's, containers. CVE happily fixed now by post package maintainers but could be of use. This is how I fixed i…
-
Quaerendir/cve-2026-109518-audit ★ 0 · Nov 4, 2026
Read-only audit for CVE-2026-109518: APT HTTP backend hard-link reuse lets an on-path attacker swap a verified package (Debian/Ubuntu)
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 2
- USN-8996-1 apt vulnerability Ubuntu Security Notices (USN) · Nov 5, 2026
- WID-SEC-2026-4341 apt: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit Administratorrechten BSI CERT-Bund (WID) · Nov 4, 2026
References
- https://lists.debian.org/debian-security-announce/2026/msg00526.html vendor-advisory
- https://ubuntu.com/security/notices/USN-8996-1 vendor-advisory