CVE-2026-109518: Why old container images need rebuilding

AWS said on November 5, 2026, that affected Debian and Ubuntu container images need to be rebuilt with fixed APT and redeployed. Updating a running host does not change a separate base image, so the host and the image are distinct patch targets for CVE-2026-109518. (AWS Security Bulletin)

For cloud teams, patch the running system and rebuild each affected image separately.

Why a host update does not fix an old image

A host update changes the packages on that running machine. It does not rewrite a container image that may later be used to launch another container. AWS’s guidance is to update affected self-managed Debian or Ubuntu instances, then rebuild affected container images with fixed APT and redeploy them. (AWS Security Bulletin)

When CVE-2026-109518 can affect APT

The flaw involves APT’s handling of redirected HTTP downloads and reused hard links. APT may merge downloads when redirects send them to the same URI; during a retry, incorrect file handling can let an attacker replace a package after its verification. A successful attack could then run code with root privileges when the package is installed. (Debian security advisory DSA-6607-1)

The attack requires someone able to manipulate the HTTP download path, along with redirects and a failed download that APT retries. The APT developers say Acquire::Retries must be set. They also say it has been the default since APT 2.3.2, while older systems may have had it enabled by scripts or administrators. (APT developers’ security notice)

Fixed APT versions by Debian and Ubuntu release

Debian’s security tracker lists the fixed builds below; its DSA specifically names APT 3.0.4 for stable trixie. Ubuntu’s security notice lists its own release-specific builds. (Debian Security Tracker; Ubuntu security notice USN-8996-1)

Ubuntu says Ubuntu Pro is required for 20.04 and older; its notice specifies Legacy Support for 16.04 and 14.04. For a derivative distribution, use that project’s own security notice for its APT build.