Debian and Ubuntu shipped fixes on November 4 for CVE-2026-109518, an APT flaw that lets network attackers swap a package after it passes verification. The tampered package’s scripts then run as root on the target machine.
Key Facts
- APT’s developers call CVE-2026-109518 critical, and Ubuntu rates it high severity with a CVSS 4.0 score of 7.7.
- Debian 12 and Ubuntu 22.04 LTS onward are exposed by default because APT retries failed downloads on those releases.
- Ubuntu’s notice USN-8996-1 lists fixed APT builds for all eight releases it tracks, covering 14.04 LTS through 26.10.
- Ubuntu says package sources reached over HTTPS block the attack, which depends on tampering with plain HTTP traffic.
- Max Justicz discovered the flaw, and CISA’s assessment in the NVD record listed exploitation as none at disclosure.
A retried download becomes a root shell
The bug lives in the HTTP backend that the APT library calls, Ubuntu said in its advisory. That puts apt, apt-get, aptitude and Ubuntu’s graphical software tools in scope. Anyone who can rewrite traffic between a machine and its archive server can play attacker, including a malicious mirror or proxy. The attack fires only when the target installs a package.
APT’s developers wrote that the attacker uses HTTP redirects and ordinary temporary server errors to push APT into retrying the download. Ubuntu’s USN-8996-1 says APT “incorrectly handled hard links” during those redirects and retries. Debian says that lets an attacker replace a package after it has been verified. Since a .deb runs its install scripts as root, the swap hands over the whole system.
One setting decides exposure. Acquire::Retries controls whether APT retries a failed download, and at 0 the bug can’t be exploited. Debian 11 and Ubuntu 20.04 don’t retry by default, though APT’s developers warn that many user scripts have switched the setting on anyway.
The target here is the delivery path, unlike malware planted inside npm and PyPI packages, where the poisoned code sits in the registry. Ubuntu notes that once users update APT, a compromised mirror stops posing a risk because archive signatures do their job again.
Fixes are available for CVE-2026-109518, a High severity vulnerability in APT, the package manager used in Debian, Ubuntu, and derivative Linux distributions. The CVE has a CVSS 4.0 score of 7.7. Remediation details are available on our blog. https://t.co/x3q5jIeD4J https://t.co/ocIkYASiIQ
— Ubuntu (@ubuntu) November 4, 2026
Ubuntu says HTTPS sources block the attack
The first advisories from Debian, Ubuntu and APT’s developers described the attack over HTTP without saying whether HTTPS sources were exposed. Ubuntu’s follow-up settles it. “The use of TLS via HTTPS protects against this vulnerability,” Ubuntu wrote. FTP and other transports aren’t affected, and snap packages use a separate system.
Switching sources from http:// to https:// helps reduce risk, with a catch. Some community mirrors, including some country-specific ones, don’t support HTTPS, so apt update can throw errors after the change.
Ubuntu’s fixed builds include 2.4.15ubuntu0.1 for 22.04 LTS, 2.8.4ubuntu0.1 for 24.04 LTS, 3.2.1ubuntu0.1 for 26.04 LTS and 3.3.3ubuntu0.1 for 26.10. Ubuntu 20.04 LTS and older get fixes through Ubuntu Pro.
Debian fixed Debian 13 in APT 3.0.4 through DSA-6607-1, and Debian 12 in 2.6.2 through the LTS advisory DLA-4880-1. Debian 11 lost long-term support on August 31, yet APT’s developers published a fixed 2.2.5 build for it anyway. Unstable now carries the fixed 3.3.6. Testing was still on the vulnerable 3.3.5 at 14:58 UTC on disclosure day, according to the Debian security tracker.
Admins can check what they’re running with apt list –installed ‘?source-package(^apt$)’. Ubuntu recommends upgrading with retries switched off: sudo apt update && sudo apt upgrade -o Acquire::Retries=0. That closes the hole while the fix itself downloads. On untrusted networks, Ubuntu suggests moving sources to HTTPS before updating, to remove that window too.
What’s Next?
Which derivative distributions are exposed? Ubuntu says distributions built on Debian and Ubuntu are affected but hasn’t named any. And when does Debian testing get the fix? None of the advisories gives a date.
The awkward part is that the patch travels down the same download path the bug abuses. A machine updating itself through a hostile proxy is exposed until the new APT lands, unless retries are off. Unattended-upgrades, on by default since Ubuntu 16.04 LTS, applies security updates every 24 hours. That should cover most stock Ubuntu systems within a day, leaving servers that retry over plain HTTP mirrors to patch by hand today.
