CVE-2026-109518 can let an attacker who manipulates HTTP traffic between an APT client and its package archive trigger installation of an attacker-controlled, unverified package and remote code execution with root privileges. The Debian Security Tracker describes the attack as requiring several conditions to coincide: hard-link reuse, redirects, a retried package download, and a nonzero Acquire::Retries setting. The tracker’s CVE entry gives the affected Debian versions and listed fixes. Cybersecurity News reported on November 4, 2026, that Debian had disclosed the vulnerability that day.
What the attack requires
An on-path attacker must be able to manipulate HTTP traffic between the APT client and the archive server. The tracker gives a malicious mirror or proxy as examples. The client must also:
- Reuse hard links.
- Follow redirects.
- Retry a package-file download.
- Have a nonzero
Acquire::Retriesvalue.
The risk described by the tracker depends on these conditions together; an attacker-controlled package can then lead to code execution with root privileges.
APT versions listed for Debian
The Debian Security Tracker lists these vulnerable and fixed versions:
| Debian release | APT version | Tracker status |
| bookworm | 2.6.1 | Vulnerable |
| bookworm (security) | 2.6.2 | Fixed |
| trixie | 3.0.3 | Vulnerable |
| trixie (security) | 3.0.4 | Fixed |
| forky and sid | 3.3.6 | Fixed |
The retry setting and Ubuntu
The tracker says Acquire::Retries defaults to 3 beginning with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy). It says older releases are unaffected in their default configuration. The tracker’s general vulnerability description also includes Ubuntu.
Setting Acquire::Retries to zero removes the nonzero-retry condition described by the tracker. Cybersecurity News characterized that setting as a stopgap and noted that it may make updates less reliable on poor connections.
