CVE-2026-119083 - GluonTS arbitrary file write during archive extraction
CVE-2026-119083
Summary
Bulletin ID: 2026-172-AWS
Publication Date: 11/05/2026 20:00 PM PST
Description:
An issue in the APT package manager (CVE-2026-109518) affects Ubuntu and Debian operating systems. Under specific conditions, when APT is configured to use HTTP package sources with retry settings enabled, a third party with a network position between the host and the package mirror could cause APT to install a package that did not pass verification. Updated APT packages are available from Canonical (USN-8996-1) and Debian (DSA-6607-1).
The following fixed versions address this issue:
- Ubuntu 22.04 LTS: apt 2.4.15ubuntu0.1
- Ubuntu 24.04 LTS: apt 2.8.4ubuntu0.1
- Ubuntu 26.04 LTS: apt 3.2.1ubuntu0.1
- Debian (DSA-6607-1): See Debian Security Advisory for version details
Customers running Ubuntu or Debian-based Amazon EC2 instances or container images should apply the updates. For details, see the full AWS Security Bulletin.
Read this article
Products covered
A separate affected-products list was not included in the collected bulletin.
Remediation
Updated APT packages are available from Canonical (USN-8996-1) and Debian (DSA-6607-1).
CVEs in this advisory 1
Updates
- Published by AWS
The publication date reported by the vendor.
- Added to SecurityAlert
We collected the advisory from the official source.
- Confirmed at the source
Our collector saw this advisory during a later source check.