Bulletin ID: 2026-172-AWS
Publication Date: 11/05/2026 20:00 PM PST
Description:
An issue in the APT package manager (CVE-2026-109518) affects Ubuntu and Debian operating systems. Under specific conditions, when APT is configured to use HTTP package sources with retry settings enabled, a third party with a network position between the host and the package mirror could cause APT to install a package that did not pass verification. Updated APT packages are available from Canonical (USN-8996-1) and Debian (DSA-6607-1). The following fixed versions address this issue:
– Ubuntu 22.04 LTS: apt 2.4.15ubuntu0.1
– Ubuntu 24.04 LTS: apt 2.8.4ubuntu0.1
– Ubuntu 26.04 LTS: apt 3.2.1ubuntu0.1
– Debian (DSA-6607-1): See Debian Security Advisory for version details
Customers running Ubuntu or Debian-based Amazon EC2 instances or container images should apply the updates. For details, see the full AWS Security Bulletin.
Read the original article:
CVE-2026-109518 – APT package manager that affects Ubuntu and Debian operating systems