A high-severity APT flaw could let an attacker controlling HTTP package-download traffic replace a package after verification. Debian and Ubuntu released security updates on November 4, 2026.
What happened
Debian and Ubuntu disclosed CVE-2026-109518, a vulnerability in the APT package manager used to install and update software. Ubuntu rates it High, with a CVSS v4.0 score of 7.7.
An on-path attacker who can manipulate HTTP traffic between an affected system and its package mirror, or who controls a malicious mirror or proxy, may be able to cause APT to install an attacker-controlled, unverified .deb package. Because package maintainer scripts can run as root during installation, successful exploitation can lead to root-level code execution.
The flaw was reported by researcher Max Justicz, whom both Canonical’s blog and Debian’s advisory credit. Debian and Ubuntu provided corrected APT packages on November 4, 2026. Sources: Ubuntu security explanation, Debian security advisory DSA-6607-1 and Debian’s security tracker.
The two distributions label it differently. Ubuntu rates it High, while Debian’s APT announcement calls it a critical file verification bypass. The vendor advisories reviewed do not report exploitation in the wild.
How package verification can be bypassed
APT normally uses signed repository information and package hashes to check downloaded software, including when packages come from mirrors that are not independently trusted. This vulnerability occurs in APT’s HTTP download handling.
Under specific redirect and retry conditions, the client can reuse hard links incorrectly and allow attacker-controlled downloaded content to replace a package file after verification. Debian’s advisory describes the cause as APT merging two different package downloads that an HTTP redirect gives the same URI, so that a man-in-the-middle can replace a package after verification when a download is resumed (DSA-6607-1). The Debian tracker and Ubuntu’s CVE page attribute it to the reuse of hard links. The attacker needs an HTTP path or mirror they can manipulate and the client must encounter the necessary redirect/retry sequence. A nonzero Acquire::Retries setting is required for exploitation.
The vulnerability affects APT-based tools, not just one command-line frontend. Canonical identifies apt, apt-get, aptitude and graphical APT applications. It does not affect Snap package installation, which uses a different mechanism.
Affected releases and corrected versions
Acquire::Retries is nonzero by default beginning with Debian 12 and Ubuntu 22.04 LTS. Older releases can be affected when retries were enabled explicitly, and supported older Ubuntu releases also received corrected packages.
Debian
| Release | Fixed APT version |
|---|---|
| Debian 12 Bookworm | 2.6.2 |
| Debian 13 Trixie | 3.0.4 |
| Forky (development branch) | 3.3.6 |
| Sid (unstable) | 3.3.7 |
Source: Debian CVE tracker. The tracker also lists the Forky and Sid development branches as fixed. Older Debian release channels must be checked against their own advisories.
Ubuntu
| Release | Fixed APT version |
|---|---|
| Ubuntu 22.04 LTS | 2.4.15ubuntu0.1 |
| Ubuntu 24.04 LTS | 2.8.4ubuntu0.1 |
| Ubuntu 26.04 LTS | 3.2.1ubuntu0.1 |
| Ubuntu 26.10 | 3.3.3ubuntu0.1 |
| Ubuntu 20.04 LTS (Ubuntu Pro) | 2.0.12+esm1 |
| Ubuntu 18.04 LTS (Ubuntu Pro) | 1.6.19+esm1 |
| Ubuntu 16.04 LTS (Ubuntu Pro, Legacy Support add-on) | 1.2.36+esm1 |
| Ubuntu 14.04 LTS (Ubuntu Pro, Legacy Support add-on) | 1.0.1ubuntu2.24+esm4 |
The older Ubuntu releases in the table are fixed through Ubuntu Pro and Expanded Security Maintenance coverage. Source: Ubuntu CVE-2026-109518.
What administrators should do
1. Install the corrected APT packages. Follow the security-update process for your distribution. Ubuntu’s published remediation command is:
sudo apt update && sudo apt upgrade -o Acquire::Retries=0Canonical also provides a narrower APT-source-package upgrade where a full upgrade is not possible:
sudo apt update && sudo apt install -o Acquire::Retries=0 --only-upgrade '?source-package(^apt$)'Canonical notes that unattended-upgrades, enabled by default from Ubuntu 16.04 LTS, applies the fixes within 24 hours. The retry override is applied to the package upgrade operation in these documented commands. Administrators in particularly exposed environments should consult their vendor’s mitigation guidance before updating from untrusted HTTP mirrors. On Debian, install the fixed apt package through the normal security-update process described in DSA-6607-1.
2. Verify installed versions. Ubuntu documents the following command to list packages from the APT source package:
apt list --installed '?source-package(^apt$)'Compare the results with the appropriate fixed version and installed distribution channel.
3. Consider HTTPS mirrors. HTTPS prevents the HTTP traffic manipulation required for this vulnerability when used correctly. Verify that the selected mirror supports HTTPS, and retain normal signed-repository checks. HTTPS does not replace installing the fixed APT package.
4. Use retry mitigation only as a temporary protection. Setting Acquire::Retries=0 prevents the retry condition required for this vulnerability, but administrators should install the corrected packages rather than relying indefinitely on a configuration change.
5. Investigate if compromise is suspected. Review package-management logs and evidence of unauthorized packages. Patching prevents future exploitation of the flaw but does not by itself remove a package already installed by an attacker. TechiesJournal’s article on what to do after an exploited device is patched covers why a patched system is not necessarily a clean one.
6. Rebuild container images and check cloud images. APT is present in many container and machine images built from Debian or Ubuntu bases. AWS’s bulletin 2026-172 says self-managed Ubuntu and Debian instances on EC2 are the customer’s responsibility to patch, that container images should be rebuilt and redeployed, and that Amazon Inspector can help identify affected instances.
What administrators should take away
The risk is not that all HTTP repositories are inherently unsigned. APT normally verifies package integrity against trusted signed metadata. CVE-2026-109518 allows that verification boundary to be bypassed under specific HTTP redirect and retry conditions. Updating APT is the primary fix, with HTTPS transport and retry controls providing additional protection.
Official sources
- Ubuntu security advisory for CVE-2026-109518
- Ubuntu technical explanation and remediation
- Debian CVE tracker
- Debian security advisory DSA-6607-1
- Debian APT security update announcement
- AWS security bulletin 2026-172
Sources were read on November 12, 2026. Check your distribution’s current advisory for your release before relying on the version numbers above.