CVE-2026-109518: RCE in APT on Debian and Ubuntu

CVE-2026-109518 is a critical vulnerability in APT, the package manager of Debian, Ubuntu and derivatives. An attacker positioned on the communication path between an APT client and archive servers (via a malicious proxy or compromised mirror) can manipulate HTTP traffic to trick the client into installing unverified packages with root privileges. The flaw exploits hard link reuse and requires the client to follow HTTP redirects and retry downloads (Acquire::Retries configuration).

The official CVSS score is 7.7 (High). The vulnerability affects by default Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), as the retry value is set to 3 by default; older releases are unaffected in standard configuration. Published today on NVD (2026-11-04), with strong social media attention: 26 posts in the last 24 hours and 104 total interactions. Signals are consistent on the on-path attack theme exploiting hard links and redirects.

Administrators should verify if Acquire::Retries is configured to a non-zero value (check /etc/apt/apt.conf and /etc/apt/apt.conf.d/). If not necessary, disable the retry configuration. Check APT logs for suspicious activity. Monitor APT archives and mirrors for anomalous traffic. Prepare patches as soon as available from Debian and Canonical teams. Protect APT communication with forced HTTPS configurations where possible.