Is CVE-2026-109518 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-109518 being exploited in the wild.

How severe is CVE-2026-109518?

High severity, published 4 November 2026.

Which products and versions are affected?

Canonical Ubuntu 22.04 LTS and later with default retry configuration; Debian Apt before 3.0.4.

How is CVE-2026-109518 attacked?

It is attacked over the network or from the adjacent network, in a software library.

Am I affected by CVE-2026-109518?

Check whether you run Amazon AWS, Canonical Ubuntu or Debian Apt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-109518: APT package manager hard link reuse remote code execution

CVE-2026-109518 · Severity: high · Published 2026-11-04

APT is the package manager for Debian, Ubuntu, and derivative Linux distributions. An on-path attacker who can intercept HTTP traffic between a package client and archive server can trick APT into installing an attacker-controlled package after an HTTP redirect, leading to remote code execution with root privileges. This requires the client to have HTTP retries enabled, which is the default in Debian 12+ and Ubuntu 22.04 LTS.

Technologies: Amazon AWS, Canonical Ubuntu. Vendors: Amazon, Canonical, Debian.

Quick answers

Is CVE-2026-109518 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-109518 being exploited in the wild.
How severe is CVE-2026-109518?: High severity, published 4 November 2026.
Which products and versions are affected?: Canonical Ubuntu 22.04 LTS and later with default retry configuration; Debian Apt before 3.0.4.
Is there a fix for CVE-2026-109518?: Yes: fixed in apt 3.0.4 (Debian trixie). Until then: Disable HTTP redirects or set Acquire::Retries to 0 in apt configuration until the package is upgraded. Systems with older Debian releases or Ubuntu versions prior to 22.04 LTS are unaffected by default. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-109518 attacked?: It is attacked over the network or from the adjacent network, in a software library.
Am I affected by CVE-2026-109518?: Check whether you run Amazon AWS, Canonical Ubuntu or Debian Apt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: apt 3.0.4 (Debian trixie)

Disable HTTP redirects or set Acquire::Retries to 0 in apt configuration until the package is upgraded. Systems with older Debian releases or Ubuntu versions prior to 22.04 LTS are unaffected by default.

Technical details

The vulnerability stems from improper handling of hard-linked package files when APT resumes an HTTP download after following a redirect that results in the same URI. An on-path attacker can manipulate HTTP traffic to replace a package after verification has passed, achieving arbitrary code execution as root. Exploitation requires the client's Acquire::Retries configuration to be non-zero (default value 3 in recent distributions); older releases default to zero retries and are unaffected.

Affected products

Debian apt before 3.0.4
Canonical Ubuntu 22.04 LTS and later with default retry configuration

Timeline

2026-11-04: disclosed
2026-11-04: patched: Debian DSA-6607-1 released with apt 3.0.4 fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.