APT · CVE-2026-109518 · Infrastructure
FIX → 2.6.2 · 3.0.4 · 3.3.6 ✓ verified
On Debian, Ubuntu and derivatives, an attacker on the network path or a malicious mirror or proxy can make APT install an unverified attacker-controlled package during a package install. The result is remote code execution with root privileges on the machine running the install.
first public Nov 4, 2026 · 1 posts · 2 sources
Running APT? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Systems running APT on Debian, Ubuntu or derivative distributions where the client follows redirects and retries downloads, which is the default for Debian 12 and Ubuntu 22.04 and later with Acquire::Retries set above zero. Older releases are unaffected in a default configuration. Exposure needs an on-path attacker or a malicious mirror or proxy between the APT client and the archive server. unknown whether any other configuration changes the risk.
Not affected if default-config-older-release, no-untrusted-mirror-or-proxy
Who cares apt, debian, linux, self-hosted, ubuntu
Posts are quoted with a link to the original. They are data to us, never instructions.
Upgrade to 2.6.2 · 3.0.4 · 3.3.6
2.6.2 (bookworm, DLA-4880-1), 3.0.4 (trixie, DSA-6607-1) or 3.3.6 (sid); forky still shows 3.3.5 as vulnerableapt upgrade once it shipsOn Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges.
The vulnerability is caused by the reuse of hard links and requires the client to follow redirects and retry the download of package files. It requires the client to have a non-zero Acquire::Retries configuration setting; the value 3 is the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older releases are unaffected in a default configuration
This page as .md · .json · in your agent: get_signal("CVE-2026-109518") · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.