CVE-2026-109518

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-109518", "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "state": "PUBLISHED", "assignerShortName": "canonical", "dateReserved": "2026-10-12T18:44:13.619Z", "datePublished": "2026-11-04T15:49:02.951Z", "dateUpdated": "2026-11-05T04:56:46.536Z"}, "containers": {"cna": {"title": "APT RCE via hard link reuse", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-62", "description": "CWE-62 UNIX hard link", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-367", "description": "CWE-367 Time-of-check time-of-use (TOCTOU) race condition", "type": "CWE"}]}], "affected": [{"vendor": "Debian", "product": "APT", "packageName": "apt", "versions": [{"status": "affected", "version": "0", "lessThan": "1.2.36", "versionType": "dpkg"}, {"status": "affected", "version": "1.4.0", "lessThan": "1.4.12", "versionType": "dpkg"}, {"status": "affected", "version": "1.6.0", "lessThan": "1.6.19", "versionType": "dpkg"}, {"status": "affected", "version": "1.8.0", "lessThan": "1.8.2.4", "versionType": "dpkg"}, {"status": "affected", "version": "1.8.3", "lessThanOrEqual": "1.8.5", "versionType": "dpkg"}, {"status": "affected", "version": "2.0.0", "lessThan": "2.0.12", "versionType": "dpkg"}, {"status": "affected", "version": "2.2.0", "lessThan": "2.2.5", "versionType": "dpkg"}, {"status": "affected", "version": "2.4.0", "lessThan": "2.4.15", "versionType": "dpkg"}, {"status": "affected", "version": "2.6.0", "lessThan": "2.6.2", "versionType": "dpkg"}, {"status": "affected", "version": "2.8.0", "lessThan": "2.8.4", "versionType": "dpkg"}, {"status": "affected", "version": "3.0.0", "lessThan": "3.0.4", "versionType": "dpkg"}, {"status": "affected", "version": "3.2.0", "lessThan": "3.2.1", "versionType": "dpkg"}, {"status": "affected", "version": "3.3.0", "lessThan": "3.3.6", "versionType": "dpkg"}], "defaultStatus": "unaffected"}, {"vendor": "Ubuntu", "product": "APT", "packageName": "apt", "versions": [{"status": "affected", "version": "0", "lessThan": "1.0.1ubuntu2.24+esm4", "versionType": "dpkg"}, {"status": "affected", "version": "1.2.0", "lessThan": "1.2.36+esm1", "versionType": "dpkg"}, {"status": "affected", "version": "1.6.0", "lessThan": "1.6.19+esm1", "versionType": "dpkg"}, {"status": "affected", "version": "2.0.0", "lessThan": "2.0.12+esm1", "versionType": "dpkg"}, {"status": "affected", "version": "2.4.0", "lessThan": "2.4.15ubuntu0.1", "versionType": "dpkg"}, {"status": "affected", "version": "2.8.0", "lessThan": "2.8.4ubuntu0.1", "versionType": "dpkg"}, {"status": "affected", "version": "3.2.0", "lessThan": "3.2.1ubuntu0.1", "versionType": "dpkg"}, {"status": "affected", "version": "3.3.0", "lessThan": "3.3.3ubuntu0.1", "versionType": "dpkg"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges.\n\n\n\nThe vulnerability is caused by the reuse of hard links and requires the client to follow redirects and retry the download of package files. It requires the client to have a non-zero\u00a0Acquire::Retries configuration setting; the value 3 is the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older releases are unaffected in a default configuration"}], "references": [{"url": "https://lists.debian.org/debian-security-announce/2026/msg00526.html", "tags": ["vendor-advisory"]}, {"url": "https://ubuntu.com/security/notices/USN-8996-1", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 7.7, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}], "credits": [{"lang": "en", "value": "Max Justicz", "type": "reporter"}, {"lang": "en", "value": "Julian Andres Klode", "type": "remediation developer"}], "providerMetadata": {"orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "shortName": "canonical", "dateUpdated": "2026-11-04T15:49:02.951Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2026/11/msg00004.html"}, {"url": "http://www.openwall.com/lists/oss-security/2026/11/04/12"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-11-05T00:12:15.622Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-04T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-109518"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T04:56:46.536Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2026/11/msg00004.html"}, {"url": "http://www.openwall.com/lists/oss-security/2026/11/04/12"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-11-05T00:12:15.622Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-109518", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-11-04T17:34:16.834939Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-04T18:11:42.980Z"}}], "cna": {"title": "APT RCE via hard link reuse", "credits": [{"lang": "en", "type": "reporter", "value": "Max Justicz"}, {"lang": "en", "type": "remediation developer", "value": "Julian Andres Klode"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Debian", "product": "APT", "versions": [{"status": "affected", "version": "0", "lessThan": "1.2.36", "versionType": "dpkg"}, {"status": "affected", "version": "1.4.0", "lessThan": "1.4.12", "versionType": "dpkg"}, {"status": "affected", "version": "1.6.0", "lessThan": "1.6.19", "versionType": "dpkg"}, {"status": "affected", "version": "1.8.0", "lessThan": "1.8.2.4", "versionType": "dpkg"}, {"status": "affected", "version": "1.8.3", "versionType": "dpkg", "lessThanOrEqual": "1.8.5"}, {"status": "affected", "version": "2.0.0", "lessThan": "2.0.12", "versionType": "dpkg"}, {"status": "affected", "version": "2.2.0", "lessThan": "2.2.5", "versionType": "dpkg"}, {"status": "affected", "version": "2.4.0", "lessThan": "2.4.15", "versionType": "dpkg"}, {"status": "affected", "version": "2.6.0", "lessThan": "2.6.2", "versionType": "dpkg"}, {"status": "affected", "version": "2.8.0", "lessThan": "2.8.4", "versionType": "dpkg"}, {"status": "affected", "version": "3.0.0", "lessThan": "3.0.4", "versionType": "dpkg"}, {"status": "affected", "version": "3.2.0", "lessThan": "3.2.1", "versionType": "dpkg"}, {"status": "affected", "version": "3.3.0", "lessThan": "3.3.6", "versionType": "dpkg"}], "packageName": "apt", "defaultStatus": "unaffected"}, {"vendor": "Ubuntu", "product": "APT", "versions": [{"status": "affected", "version": "0", "lessThan": "1.0.1ubuntu2.24+esm4", "versionType": "dpkg"}, {"status": "affected", "version": "1.2.0", "lessThan": "1.2.36+esm1", "versionType": "dpkg"}, {"status": "affected", "version": "1.6.0", "lessThan": "1.6.19+esm1", "versionType": "dpkg"}, {"status": "affected", "version": "2.0.0", "lessThan": "2.0.12+esm1", "versionType": "dpkg"}, {"status": "affected", "version": "2.4.0", "lessThan": "2.4.15ubuntu0.1", "versionType": "dpkg"}, {"status": "affected", "version": "2.8.0", "lessThan": "2.8.4ubuntu0.1", "versionType": "dpkg"}, {"status": "affected", "version": "3.2.0", "lessThan": "3.2.1ubuntu0.1", "versionType": "dpkg"}, {"status": "affected", "version": "3.3.0", "lessThan": "3.3.3ubuntu0.1", "versionType": "dpkg"}], "packageName": "apt", "defaultStatus": "unaffected"}], "references": [{"url": "https://lists.debian.org/debian-security-announce/2026/msg00526.html", "tags": ["vendor-advisory"]}, {"url": "https://ubuntu.com/security/notices/USN-8996-1", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges.\n\n\n\nThe vulnerability is caused by the reuse of hard links and requires the client to follow redirects and retry the download of package files. It requires the client to have a non-zero\u00a0Acquire::Retries configuration setting; the value 3 is the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older releases are unaffected in a default configuration"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-62", "description": "CWE-62 UNIX hard link"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-367", "description": "CWE-367 Time-of-check time-of-use (TOCTOU) race condition"}]}], "providerMetadata": {"orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "shortName": "canonical", "dateUpdated": "2026-11-04T15:49:02.951Z"}}}, "cveMetadata": {"cveId": "CVE-2026-109518", "state": "PUBLISHED", "dateUpdated": "2026-11-05T04:56:46.536Z", "dateReserved": "2026-10-12T18:44:13.619Z", "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "datePublished": "2026-11-04T15:49:02.951Z", "assignerShortName": "canonical"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageName": "apt", "product": "APT", "vendor": "Debian", "versions": [{"lessThan": "1.2.36", "status": "affected", "version": "0", "versionType": "dpkg"}, {"lessThan": "1.4.12", "status": "affected", "version": "1.4.0", "versionType": "dpkg"}, {"lessThan": "1.6.19", "status": "affected", "version": "1.6.0", "versionType": "dpkg"}, {"lessThan": "1.8.2.4", "status": "affected", "version": "1.8.0", "versionType": "dpkg"}, {"lessThanOrEqual": "1.8.5", "status": "affected", "version": "1.8.3", "versionType": "dpkg"}, {"lessThan": "2.0.12", "status": "affected", "version": "2.0.0", "versionType": "dpkg"}, {"lessThan": "2.2.5", "status": "affected", "version": "2.2.0", "versionType": "dpkg"}, {"lessThan": "2.4.15", "status": "affected", "version": "2.4.0", "versionType": "dpkg"}, {"lessThan": "2.6.2", "status": "affected", "version": "2.6.0", "versionType": "dpkg"}, {"lessThan": "2.8.4", "status": "affected", "version": "2.8.0", "versionType": "dpkg"}, {"lessThan": "3.0.4", "status": "affected", "version": "3.0.0", "versionType": "dpkg"}, {"lessThan": "3.2.1", "status": "affected", "version": "3.2.0", "versionType": "dpkg"}, {"lessThan": "3.3.6", "status": "affected", "version": "3.3.0", "versionType": "dpkg"}]}, {"defaultStatus": "unaffected", "packageName": "apt", "product": "APT", "vendor": "Ubuntu", "versions": [{"lessThan": "1.0.1ubuntu2.24+esm4", "status": "affected", "version": "0", "versionType": "dpkg"}, {"lessThan": "1.2.36+esm1", "status": "affected", "version": "1.2.0", "versionType": "dpkg"}, {"lessThan": "1.6.19+esm1", "status": "affected", "version": "1.6.0", "versionType": "dpkg"}, {"lessThan": "2.0.12+esm1", "status": "affected", "version": "2.0.0", "versionType": "dpkg"}, {"lessThan": "2.4.15ubuntu0.1", "status": "affected", "version": "2.4.0", "versionType": "dpkg"}, {"lessThan": "2.8.4ubuntu0.1", "status": "affected", "version": "2.8.0", "versionType": "dpkg"}, {"lessThan": "3.2.1ubuntu0.1", "status": "affected", "version": "3.2.0", "versionType": "dpkg"}, {"lessThan": "3.3.3ubuntu0.1", "status": "affected", "version": "3.3.0", "versionType": "dpkg"}]}], "source": "security@ubuntu.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges.\n\n\n\nThe vulnerability is caused by the reuse of hard links and requires the client to follow redirects and retry the download of package files. It requires the client to have a non-zero\u00a0Acquire::Retries configuration setting; the value 3 is the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older releases are unaffected in a default configuration"}], "id": "CVE-2026-109518", "lastModified": "2026-11-12T20:04:52.377", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security@ubuntu.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-109518", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-04T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-11-04T16:17:33.010", "references": [{"source": "security@ubuntu.com", "url": "https://lists.debian.org/debian-security-announce/2026/msg00526.html"}, {"source": "security@ubuntu.com", "url": "https://ubuntu.com/security/notices/USN-8996-1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/11/04/12"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2026/11/msg00004.html"}], "sourceIdentifier": "security@ubuntu.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-62"}, {"lang": "en", "value": "CWE-367"}], "source": "security@ubuntu.com", "type": "Secondary"}]}

{"bugzilla": {"description": "apt: apt: Remote code execution via hard link reuse during package download retries", "id": "2567908", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567908"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-494", "details": ["On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges.\nThe vulnerability is caused by the reuse of hard links and requires the client to follow redirects and retry the download of package files. It requires the client to have a non-zero\u00a0Acquire::Retries configuration setting; the value 3 is the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older releases are unaffected in a default configuration", "A flaw was found in APT. This vulnerability allows an on-path network attacker to achieve arbitrary code execution with administrative (root) privileges by intercepting package downloads. By manipulating network traffic when a client follows redirects and retries a download, an attacker can exploit insecure hard link reuse to force the installation of an unverified, malicious package."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-109518", "package_state": [{"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Under investigation", "package_name": "apt", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-11-04T15:49:02Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-109518\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-109518\nhttp://www.openwall.com/lists/oss-security/2026/11/04/12\nhttps://lists.debian.org/debian-lts-announce/2026/11/msg00004.html\nhttps://lists.debian.org/debian-security-announce/2026/msg00526.html\nhttps://ubuntu.com/security/notices/USN-8996-1"], "statement": "In Red Hat deployments, this vulnerability is evaluated with an Important impact because an on-path adversary could achieve full administrative takeover by tampering with package downloads, an outcome warranting an Important rating over Moderate despite requiring active traffic interception. Red Hat Enterprise Linux and supported platforms natively utilize RPM and DNF rather than APT for software packaging and system management. As the APT package manager is neither shipped nor supported in standard Red Hat environments, typical installations do not expose this package retry functionality.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.2.36)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[1.4.0,1.4.12)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[1.6.0,1.6.19)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[1.8.0,1.8.2.4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[1.8.3,1.8.5]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[2.0.0,2.0.12)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[2.2.0,2.2.5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[2.4.0,2.4.15)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[2.6.0,2.6.2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[2.8.0,2.8.4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[3.0.0,3.0.4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[3.2.0,3.2.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[3.3.0,3.3.6)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "APT", "source": "cna", "vendor": "Debian"}, "product": "apt", "vendor": "debian"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.0.1ubuntu2.24+esm4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[1.2.0,1.2.36+esm1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[1.6.0,1.6.19+esm1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[2.0.0,2.0.12+esm1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[2.4.0,2.4.15ubuntu0.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[2.8.0,2.8.4ubuntu0.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[3.2.0,3.2.1ubuntu0.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[3.3.0,3.3.3ubuntu0.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "APT", "source": "cna", "vendor": "Ubuntu"}, "product": "apt", "vendor": "ubuntu"}], "created": "2026-11-04T17:45:07.200892+00:00", "updated": "2026-11-12T20:38:31.292657+00:00", "vendors": ["debian", "debian$PRODUCT$apt", "ubuntu", "ubuntu$PRODUCT$apt"]}