What is CVE-2026-109518?

CVE-2026-109518 is a vulnerability in Debian Apt, classified under UNIX Hard Link. Published 2026-11-04.

Is CVE-2026-109518 known to be exploited?

3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Debian Apt

CVE-2026-109518

On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges. The vulnerability is caused by the reuse of hard links and requires the client to follow redirects and retry the download of package files. It requires the client to have a non-zero Acquire::Retries configuration setting; the value 3 is the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older releases are unaffected in a default configuration

Published 2026-11-04 · last modified 2026-11-05.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Weakness classification (CWE)

Public proof-of-concept exploits

References

lists.debian.org/debian-security-announce/2026/msg00526.html (vendor-advisory)
ubuntu.com/security/notices/USN-8996-1 (vendor-advisory)
af854a3a-2127-422b-91ae-364da2661108
af854a3a-2127-422b-91ae-364da2661108

Frequently asked questions

What is CVE-2026-109518?: CVE-2026-109518 is a vulnerability in Debian Apt, classified under UNIX Hard Link. Published 2026-11-04.
Is CVE-2026-109518 known to be exploited?: 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.