On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges. The vulnerability is caused by the reuse of hard links and requires the client to follow redirects and retry the download of package files. It requires the client to have a non-zero Acquire::Retries configuration setting; the value 3 is the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older releases are unaffected in a default configuration

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP
    traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a
    package install can trick the client into installing an attacker-controlled unverified package and achieve
    remote code execution with root privileges. The vulnerability is caused by the reuse of hard links and
    requires the client to follow redirects and retry the download of package files. It requires the client to
    have a non-zero Acquire::Retries configuration setting; the value 3 is the default starting with Debian 12
    (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older releases are unaffected in a default
    configuration (CVE-2026-109518)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP     traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a     package install can trick the client into installing an attacker-controlled unverified package and achieve     remote code execution with root privileges. The vulnerability is caused by the reuse of hard links and     requires the client to follow redirects and retry the download of package files. It requires the client to     have a non-zero Acquire::Retries configuration setting; the value 3 is the default starting with Debian 12     (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older releases are unaffected in a default     configuration (CVE-2026-109518)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dla-4880 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4880-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                 Salvatore Bonaccorso     November 04, 2026                             https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : apt     Version        : 2.6.2     CVE ID         : CVE-2026-109518

    Max Justicz discovered a vulnerability in the APT package manager. APT     can merge two different package downloads after an HTTP redirect gives     them the same URI. Improper file handling when resuming an HTTP download     allows a man-in-the-middle attacker to replace a package after     verification, resulting in the execution of arbitrary code as root.

    For Debian 12 bookworm, this problem has been fixed in version 2.6.2.
    Additionally this update addresses several out-of-bounds access issues.

    We recommend that you upgrade your apt packages.

    For the detailed security status of apt please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/apt

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
478402	Alpine: multiple apt packages: security update to 3.2.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
478402	Alpine: multiple apt packages: security update to 3.2.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
376186	Linux Distros Unpatched Vulnerability : CVE-2026-109518	Nessus	Misc.	Local	high
376165	Debian dla-4880 : apt - security update	Nessus	Debian Local Security Checks	Local	high

Detections

Analytics

CVE-2026-109518

high

Tenable Plugins

high

high

high

high