CVE-2026-109518 - APT package manager that affects Ubuntu and Debian operating systems
Bulletin ID: 2026-172-AWS Publication Date: 11/05/2026 20:00 PM PST Description: An issue in the APT package manager (CVE-2026-109518) affects Ubuntu and Debian operating systems. Under specific conditions, when APT is configured to use HTTP package sources with retry settings enabled, a third party with a network position between the host and the package mirror could cause APT to install a package that did not pass verification. Updated APT packages are available from Canonical (USN-8996-1) and Debian (DSA-6607-1). The following fixed versions address this issue: - Ubuntu 22.04 LTS: apt 2.4.15ubuntu0.1 - Ubuntu 24.04 LTS: apt 2.8.4ubuntu0.1 - Ubuntu 26.04 LTS: apt 3.2.1ubuntu0.1 - Debian (D
Read at AWS Security Bulletins
- Vendor
- Amazon Web Services, Canonical, Debian
- Product
- Ubuntu, Debian
- EPSS
- 0.009 (p61)
- Fix
- available
- Exposure class
- Operating system
Why it ranks 45 (High)
- Product class: operating system
- Widely deployed vendor product (Amazon Web Services)
- Covered by 2 independent sources
- Fix available
- Vendor security advisory
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- AWS Security Bulletins (aws.amazon.com)
- CVE-2026-109518 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.