VULNpocalypse
HighVulnerabilityMonitoring

Debian and Ubuntu APT flaw CVE-2026-109518 lets a MitM swap verified packages and run code as root

A flaw in APT, tracked as CVE-2026-109518, lets a network attacker swap a verified package for a malicious one and run code as root on Debian and Ubuntu.

Published
Ecosystem
Open source
Fixed in
Debian bookworm APT 2.6.2, Debian trixie APT 3.0.4, Debian 11 APT 2.2.5, Ubuntu 26.10 3.3.3ubuntu0.1, Ubuntu 26.04 LTS 3.2.1ubuntu0.1, Ubuntu 24.04 LTS 2.8.4ubuntu0.1, Ubuntu 22.04 LTS 2.4.15ubuntu0.1, upstream APT 3.3.6
Exploitation
No, neither source reports attacks exploiting the flaw

Live scores

CVE-2026-109518
EPSS
0.000
low predicted chance of attack
VEDAS
0.049
little exploit evidence
On CISA KEV
Not listed
Detection rule
None yet

What happened

APT, the package manager for Debian and Ubuntu, has a flaw tracked as CVE-2026-109518. It lets an attacker who can modify package downloads swap a checked package for their own, and the attacker’s code then runs as root. According to The Hacker News, Debian, Ubuntu and APT’s developers published advisories on November 4, 2026. Max Justicz reported the flaw, according to both Cyber Security News and The Hacker News.

Cyber Security News reports, citing Debian, that APT can merge two different package downloads after an HTTP redirect gives it the same address. When APT resumes an interrupted download, it mishandles the file. That opens a short window to replace the package after it has been verified, so the installed package is the attacker’s version. The flaw also depends on hard link reuse.

The attacker must sit between the computer and the archive server. The Hacker News says that could be a malicious mirror or proxy, and that the attacker uses HTTP redirects and ordinary temporary server errors to make APT retry the download. Cyber Security News adds that a same-network attacker is also possible.

Ratings differ by publisher. Ubuntu rates the flaw high priority with a CVSS 4.0 score of 7.7, and APT’s developers call it critical, both as reported by The Hacker News. Neither source reports attacks exploiting the flaw.

Cyber Security News notes that a similar APT redirect bug, CVE-2019-3462, was found by the same researcher in 2019. It describes the new flaw as a different bug.

Am I affected?

You are likely affected if you run APT on Debian, Ubuntu or a derivative and it fetches packages over HTTP, and the retry setting Acquire::Retries is above zero.

  • Default exposure: Acquire::Retries is 3 by default on Debian 12 (bookworm) and Ubuntu 22.04 LTS, according to Cyber Security News. Older releases such as Debian 11 and Ubuntu 20.04 are not exposed by default, according to Ubuntu as reported by The Hacker News. APT’s developers say many user scripts may have enabled the setting on those releases anyway.
  • Vulnerable versions listed by the Debian Security Tracker (per Cyber Security News): bookworm 2.6.1, trixie 3.0.3, and testing and unstable (forky, sid) 3.3.5. The tracker points to DSA-6607-1 for trixie and DLA-4880-1 for bookworm.
  • Ubuntu: at 15:46 UTC on November 4, Ubuntu still marked all eight releases it tracks, from 14.04 LTS to 26.10, as vulnerable (The Hacker News).
  • Derivatives: Ubuntu says distributions built on Debian and Ubuntu are affected too, without naming any (The Hacker News). Cyber Security News says derivatives need their own patches.
  • HTTPS sources: The Hacker News says the advisories describe the attack over HTTP and do not say whether sources reached over HTTPS are exposed. Cyber Security News advises preferring HTTPS mirrors because they make interception harder. Whether HTTPS fully protects is not confirmed.

Check your installed version with apt --version and compare it to the fixed versions below.

What to do now

  1. Update APT with apt update and apt upgrade, ideally on a trusted network, and confirm the installed version matches the fixed one for your release. - Debian bookworm: 2.6.2. Debian trixie: 3.0.4, which also closes several out-of-bounds access bugs (Cyber Security News). - Debian 11: APT’s developers published fixed version 2.2.5, though Debian long-term support for it ended on August 31 (The Hacker News). - Debian testing: version 3.3.5 was still vulnerable at 14:58 UTC on November 4 (The Hacker News). A fixed testing version is not confirmed.
  2. On Ubuntu, install the new security archive builds published at 14:25 UTC on November 4 (The Hacker News): - 26.10: 3.3.3ubuntu0.1 - 26.04 LTS: 3.2.1ubuntu0.1 - 24.04 LTS: 2.8.4ubuntu0.1 - 22.04 LTS: 2.4.15ubuntu0.1
  3. For other Ubuntu releases, watch Ubuntu’s notices. The Hacker News says updates for Ubuntu and Ubuntu Pro are being released, and that Ubuntu 14.04 users with Ubuntu Pro can already get one. Fixed versions for the remaining releases are not confirmed.
  4. Until you have patched, avoid untrusted mirrors, proxies and public networks, and prefer HTTPS mirrors where possible (Cyber Security News).
  5. As a stopgap on unpatched systems, Cyber Security News suggests setting Acquire::Retries to 0, which removes one required condition but can make updates less reliable on poor connections. The Hacker News says the three advisories it reviewed offer no workaround, so treat this as unofficial.
  6. On older releases, search your scripts and APT configuration for Acquire::Retries, since users may have enabled it.
  7. Upstream APT 3.3.6 makes the download methods open target files exclusively, which stops two downloads from touching the same file. It also rejects DEB packages that lack the required Version field and fixes a dependency solver sorting bug (Cyber Security News).

Sources