TI-2026-85087 Aliases CVE-2026-109518 GHSA-jw32-37xr-xwfw

APT hard link reuse lets attackers execute code as root

LOW 37CWE-367Published 2026-11-04 · Updated 2026-11-05

Key facts

Attack vector: Network
Privileges required: None
User interaction: Passive
Attack complexity: Low
Attack requirements: Present
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Partial Red Hat: 1 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

The APT package manager on Debian, Ubuntu and derivative distributions reuses hard links (CWE-62) when fetching package files. An on-path attacker who can manipulate HTTP traffic, including a malicious mirror or proxy, can make a package install fetch an attacker-controlled unverified package and run code as root. The client must follow redirects and retry downloads with a non-zero Acquire::Retries setting, which is 3 by default on Debian 12 (bookworm) and Ubuntu 22.04 LTS.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges. The vulnerability is caused by the reuse of hard links and requires the client to follow redirects and retry the download of package files. It requires the client to have a non-zero Acquire::Retries configuration setting; the value 3 is the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older releases are unaffected in a default configuration

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00928 60th percentileScored 2026-11-07

Fix Partial APT (Debian): 1.2.36, 1.4.12, 1.6.19 +9APT (Ubuntu): 1.0.1ubuntu2.24+esm4, 1.2.36+esm1, 1.6.19+esm1 +5Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Debian	APT	before 1.2.36; 1.4.0 to before 1.4.12; 1.6.0 to before 1.6.19; 1.8.0 to before 1.8.2.4; 1.8.3 – 1.8.5; 2.0.0 to before 2.0.12; 2.2.0 to before 2.2.5; 2.4.0 to before 2.4.15; 2.6.0 to before 2.6.2; 2.8.0 to before 2.8.4; 3.0.0 to before 3.0.4; 3.2.0 to before 3.2.1; 3.3.0 to before 3.3.6	1.2.36, 1.4.12, 1.6.19, 1.8.2.4, 2.0.12, 2.2.5, 2.4.15, 2.6.2, 2.8.4, 3.0.4, 3.2.1, 3.3.6	Patch available	CNA
Ubuntu	APT	before 1.0.1ubuntu2.24+esm4; 1.2.0 to before 1.2.36+esm1; 1.6.0 to before 1.6.19+esm1; 2.0.0 to before 2.0.12+esm1; 2.4.0 to before 2.4.15ubuntu0.1; 2.8.0 to before 2.8.4ubuntu0.1; 3.2.0 to before 3.2.1ubuntu0.1; 3.3.0 to before 3.3.3ubuntu0.1	1.0.1ubuntu2.24+esm4, 1.2.36+esm1, 1.6.19+esm1, 2.0.12+esm1, 2.4.15ubuntu0.1, 2.8.4ubuntu0.1, 3.2.1ubuntu0.1, 3.3.3ubuntu0.1	Patch available	CNA

APT VendorDebian Affected before 1.2.36; 1.4.0 to before 1.4.12; 1.6.0 to before 1.6.19; 1.8.0 to before 1.8.2.4; 1.8.3 – 1.8.5; 2.0.0 to before 2.0.12; 2.2.0 to before 2.2.5; 2.4.0 to before 2.4.15; 2.6.0 to before 2.6.2; 2.8.0 to before 2.8.4; 3.0.0 to before 3.0.4; 3.2.0 to before 3.2.1; 3.3.0 to before 3.3.6 Fixed in 1.2.36, 1.4.12, 1.6.19, 1.8.2.4, 2.0.12, 2.2.5, 2.4.15, 2.6.2, 2.8.4, 3.0.4, 3.2.1, 3.3.6 Patch available CNA
APT VendorUbuntu Affected before 1.0.1ubuntu2.24+esm4; 1.2.0 to before 1.2.36+esm1; 1.6.0 to before 1.6.19+esm1; 2.0.0 to before 2.0.12+esm1; 2.4.0 to before 2.4.15ubuntu0.1; 2.8.0 to before 2.8.4ubuntu0.1; 3.2.0 to before 3.2.1ubuntu0.1; 3.3.0 to before 3.3.3ubuntu0.1 Fixed in 1.0.1ubuntu2.24+esm4, 1.2.36+esm1, 1.6.19+esm1, 2.0.12+esm1, 2.4.15ubuntu0.1, 2.8.4ubuntu0.1, 3.2.1ubuntu0.1, 3.3.3ubuntu0.1 Patch available CNA

Remediation

Upgrade Debian APT to 1.2.36, 1.4.12, 1.6.19, 1.8.2.4, 2.0.12, 2.2.5, 2.4.15, 2.6.2, 2.8.4, 3.0.4, 3.2.1 or 3.3.6. Upgrade Ubuntu APT to 1.0.1ubuntu2.24+esm4, 1.2.36+esm1, 1.6.19+esm1, 2.0.12+esm1, 2.4.15ubuntu0.1, 2.8.4ubuntu0.1, 3.2.1ubuntu0.1 or 3.3.3ubuntu0.1. The sources list no fixed version for Red Hat Hardened Images.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Fix · CNA APT (Debian) Fixed in 1.2.36, 1.4.12, 1.6.19, 1.8.2.4, 2.0.12, 2.2.5, 2.4.15, 2.6.2, 2.8.4, 3.0.4, 3.2.1, 3.3.6
Fix · CNA APT (Ubuntu) Fixed in 1.0.1ubuntu2.24+esm4, 1.2.36+esm1, 1.6.19+esm1, 2.0.12+esm1, 2.4.15ubuntu0.1, 2.8.4ubuntu0.1, 3.2.1ubuntu0.1, 3.3.3ubuntu0.1

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Hardened Images	Affected	—

Timeline

2026-11-04 Threatist record created from CVE-2026-109518
2026-11-04 CISA SSVC decision points changed
2026-11-04 Priority changed: MEDIUM → LOW
2026-11-04 Alias added: GHSA-jw32-37xr-xwfw
2026-11-05 CISA SSVC decision points changed
2026-11-06 Affected versions changed · Red Hat
2026-11-06 CVSS score added · Red Hat

References

Advisory 2

TI-2026-19388 telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root"… KEVCVSS 3.1CRITICAL 9.8
TI-2025-31204 Deserialization of untrusted data in Roundcube Webmail KEVCVSS 3.1CRITICAL 9.9
TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
TI-2025-23504 Erlang/OTP SSH Vulnerable to Pre-Authentication RCE KEVCVSS 3.1CRITICAL 10.0
TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
TI-2025-17951 Out-of-bounds write in Apple Safari KEVCVSS 3.1CRITICAL 10.0

See all 10170 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences