A package manager is supposed to be the trust anchor of a Linux system. It verifies signatures, checks hashes, and refuses to install anything that does not match. That is the entire premise.

CVE-2026-109518 breaks that premise, but only under one specific condition. The attacker needs to be able to modify the HTTP traffic between APT and the package server. If they can, they can swap a checked package for one of their own, and that code runs as root.

Debian, Ubuntu, and APT's developers published advisories on November 4. The attack requires APT to retry a failed download, which it does by default from Debian 12 and Ubuntu 22.04 onward.

Who Is Exposed

The retry behavior is the deciding factor. Older releases, such as Debian 11 and Ubuntu 20.04, do not retry by default, so they are not exposed out of the box.

But that reassurance comes with a caveat. APT's developers noted that many user scripts may have enabled Acquire::Retries on those older releases anyway. If a script turned it on for reliability reasons, the protection is gone.

Ubuntu rates the flaw as high priority with a CVSS 4.0 score of 7.7. APT's own developers call it critical.

Ubuntu published those four builds at 14:25 UTC on November 4. At 15:46 UTC, it still marked all eight releases it tracks, from 14.04 LTS through 26.10, as vulnerable on its tracker.

Debian 11 is a special case. Debian long-term support for that release ended on August 31, but APT's developers still published a fixed version, 2.2.5. That is not standard practice for an end-of-life branch, and it signals how seriously the maintainers are treating this.

How the Attack Works

The mechanism is not exotic. It relies on how APT handles a failed download.

An attacker uses HTTP redirects and ordinary temporary server errors to make APT retry. On the retry, the swapped package is served in place of the legitimate one. Because the download is retried rather than freshly verified, the substitution succeeds.

Ubuntu's description of the attacker is broad. It is anyone who can change the HTTP traffic between APT and the package server. That includes a malicious mirror, a compromised proxy, or anyone positioned to intercept the connection.

The attack executes when the computer installs a package. No user interaction beyond the normal apt install is required.

The HTTPS Question

Here is a gap worth noting. All three advisories describe the attack over HTTP. None of them state whether package sources reached over HTTPS are exposed.

That omission is significant, and it is not the same as saying HTTPS is safe. It means the researchers have not made a claim either way. If you assumed HTTPS sources were automatically protected, the advisories do not confirm that assumption.

The honest reading is that the vulnerability is confirmed over HTTP, and the HTTPS case is unaddressed.

What to Do

• Patch immediately. Debian has released fixed APT versions. Ubuntu has published builds for 22.04, 24.04, 26.04, and 26.10 in its security archive.
• Check whether retries are enabled. If you are on Debian 11 or Ubuntu 20.04, verify whether Acquire::Retries is set anywhere in your configuration or scripts. If it is, treat the system as exposed until patched.
• Prefer HTTPS package sources. The advisories do not confirm that HTTPS sources are protected, but they do not rule it out either, and HTTPS removes the class of attacker described here.
• Audit your mirrors. A malicious mirror is one of the named attack vectors. Confirm you are pulling from sources you actually trust, not a random mirror picked for speed.
• Watch for unexpected redirects. HTTP redirects during package downloads are part of the attack chain. Unusual redirect behavior from a mirror is worth investigating.
• Run the update on Debian testing specifically. Debian's testing branch was still on the vulnerable 3.3.5 at the time of the advisory. Check your version directly rather than assuming the tracker has caught up.
• Note that no workaround was published. None of the three advisories offer a mitigation for systems that cannot update yet. Patching is the only answer.

Why This One Is Structurally Serious

Most package manager vulnerabilities require either a compromised repository signing key or a local privilege escalation. This one does not.

It exploits the difference between the download and the install. APT verifies the package it downloads. If that package is swapped during a retry, the verification applies to the first attempt, not the second.

That is a subtle failure in a trust boundary that administrators rely on implicitly. Every apt install is an act of faith in the delivery path. This flaw shows that the faith was slightly misplaced.

FAQ

What is CVE-2026-109518?

It is a vulnerability in APT, the package manager used by Debian and Ubuntu. An attacker who can modify HTTP traffic between APT and the package server can swap a verified package for their own during a download retry, and the attacker's code runs as root.

Which systems are exposed by default?

Debian 12 and Ubuntu 22.04 onward, because APT retries failed downloads by default on those releases.

What about Debian 11 and Ubuntu 20.04?

They do not retry by default, so they are not exposed out of the box. However, APT's developers noted that many user scripts may have enabled Acquire::Retries on those releases anyway. Check your configuration.

Which versions are fixed?

Debian has published fixed APT versions. Ubuntu published 3.3.3ubuntu0.1 (26.10), 3.2.1ubuntu0.1 (26.04 LTS), 2.8.4ubuntu0.1 (24.04 LTS), and 2.4.15ubuntu0.1 (22.04 LTS) to its security archive on November 4.

Does HTTPS protect me?

The advisories describe the attack over HTTP and do not state whether HTTPS package sources are exposed. That is not a confirmation that HTTPS is safe, and it is not a confirmation that it is vulnerable. The question is unaddressed.

Is there a workaround?

None of the three advisories offer a workaround for systems that cannot update yet.

Who reported the flaw?

Max Justicz reported it.

Is this being exploited in the wild?

None of the three advisories describe attacks exploiting the flaw.

Source: The Hacker News