CVE-2026-109518
APT RCE via hard link reuse
Using APT by Debian?
Get instant alerts when new vulnerabilities affect APT - before attackers find them.
Description
On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges. The vulnerability is caused by the reuse of hard links and requires the client to follow redirects and retry the download of package files. It requires the client to have a non-zero Acquire::Retries configuration setting; the value 3 is the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older releases are unaffected in a default configuration
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
Remediation
VTDB RemediationWorkaround
VTDB RemediationAI-generated · claude-opus-5-5 · published by VulnTracker
Upgrade the apt package on every Debian and Ubuntu host to the build named in the Debian advisory or USN-8996-1, and set Acquire::Retries to 0 until you have, because a malicious mirror or proxy can otherwise get an unverified package installed as root.
- 1
Find exposed hosts: apt version and Acquire::Retries
On every Debian, Ubuntu and derivative host, record the installed apt package version and the effective Acquire::Retries value. The flaw requires a non-zero Acquire::Retries; 3 is the default from Debian 12 (bookworm) and Ubuntu 22.04 LTS onward, so older releases are not affected in a default configuration unless retries were turned on. Fix first the hosts that fetch packages over HTTP through mirrors or proxies you do not fully control.
Fact: CVE description (requires non-zero Acquire::Retries, redirects, and an on-path attacker such as a malicious mirror or proxy)
- 2
Upgrade apt on Debian hosts per the Debian advisories
Install the fixed apt package from the Debian security announcement, or the Debian LTS announcement for LTS releases. Our records give the following as the first versions outside each affected range; they are inferred from range bounds, not named by Debian in our data: 1.2.36, 1.4.12, 1.6.19, 1.8.2.4, 2.0.12, 2.2.5, 2.4.15, 2.6.2, 2.8.4, 3.0.4, 3.2.1 and 3.3.6. Confirm the exact package version for your release in the announcement before relying on it.
https://lists.debian.org/debian-security-announce/2026/msg00526.html - 3
Upgrade apt on Ubuntu hosts per USN-8996-1
Install the fixed apt package listed in USN-8996-1 for your Ubuntu release. For package versions with ubuntu/+esm suffixes, our records give these as the first versions outside each affected range, inferred from range bounds and not named by the vendor in our data: 1.0.1ubuntu2.24+esm4, 1.2.36+esm1, 1.6.19+esm1, 2.0.12+esm1, 2.4.15ubuntu0.1, 2.8.4ubuntu0.1, 3.2.1ubuntu0.1 and 3.3.3ubuntu0.1. Check them against the notice.
https://ubuntu.com/security/notices/USN-8996-1 - 4
Set Acquire::Retries to 0 until the upgrade is in place
The vulnerable path is used only when the client retries downloads, so set Acquire::Retries to 0 in the APT configuration on hosts you cannot upgrade immediately. The upgrade itself does not depend on this setting, so the apt package update can be fetched with retries disabled. Restore your preferred value after upgrading.
Fact: CVE description (requires a non-zero Acquire::Retries configuration setting)
If you cannot apply the fix
Set Acquire::Retries to 0 in the APT configuration. The CVE description says the attack requires a non-zero value, and releases older than Debian 12 and Ubuntu 22.04 LTS are unaffected in a default configuration because they did not enable retries. The facts do not state how the vendors recommend applying this, so check the Debian and Ubuntu advisories for their own mitigation guidance.
The record has no fixes entries, so every version above is our inference from affected-range upper bounds, not a vendor statement; take the authoritative fixed package versions from the Debian announcements and USN-8996-1. In the Debian data, apt 1.8.3 through 1.8.5 is affected with no recorded upper fix bound, so we have no fixed version for that span. The two product entries disagree on the 3.3 line (3.3.6 in the Debian data, 3.3.3ubuntu0.1 in the Ubuntu-style data). The Ubuntu-style entry treats 2.4.15 and 2.8.4 as still affected while the Debian entry lists them as the first unaffected versions, so the upstream numbers may not map one-to-one to fixed packages. The facts contain no KEV entry or vendor advisory records, and no exploitation is recorded (is_exploited is false, SSVC exploitation is none).
Guidance updated 2026-11-05
References (4)
SSVC — Action Prioritization
SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.
CVSS
Quick Info
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.