Skip to main content

CVE-2026-109518 - APT package manager that affects Ubuntu and Debian operating systems

Bulletin ID: 2026-172-AWS
Scope: AWS
Content Type: Important (requires attention)/Informational
Publication Date: 11/05/2026 20:00 PM PST


Description:

On November 4, 2026, Canonical and Debian published updates addressing an issue in the APT package manager (CVE-2026-109518) that affects Ubuntu and Debian operating systems. Under specific conditions, when APT is configured to use HTTP package sources with retry settings enabled, a third party with a network position between the host and the package mirror could cause APT to install a package that did not pass verification. Ubuntu 22.04 LTS and later, and Debian 12 and later, are affected in their default configuration. Maintainer scripts within such a package would then run with elevated privileges.

Updated APT packages that address this issue are available from Canonical (USN-8996-1) and Debian (DSA-6607-1).

We will update this bulletin as more information becomes available.

If you have consumed an Ubuntu 22.04 vended AMI from AWS, please ensure you take the recommended actions below.

Customer Impact and Recommended Actions:

Customers who run Ubuntu or Debian-based Amazon EC2 instances, or use Ubuntu or Debian in container images, should review their environments and apply the updated APT packages provided by Canonical and Debian. The following fixed versions address this issue:

  • Ubuntu 22.04 LTS: apt 2.4.15ubuntu0.1
  • Ubuntu 24.04 LTS: apt 2.8.4ubuntu0.1
  • Ubuntu 26.04 LTS: apt 3.2.1ubuntu0.1
  • Debian (DSA-6607-1): See Debian Security Advisory for version details

To update, run the following commands on affected instances:

sudo apt-get update && sudo apt-get upgrade -o Acquire::Retries=0

As a best practice, we recommend that customers configure their APT package sources to use HTTPS rather than HTTP. For more information on securing your Ubuntu instances, refer to the Ubuntu Security Notices page and the Debian Security Advisories page.

Customers using Amazon Inspector can use it to identify EC2 instances in their environment that may be affected by this issue. For more information, see the Amazon Inspector documentation.

References:


If you have questions or concerns, please reach out to AWS Support at https://aws.amazon.com/support.