Debian and Ubuntu APT flaw CVE-2026-109518 lets man-in-the-middle attackers swap verified packages and run code as root

TLDR

• A flaw in APT, CVE-2026-109518, lets a man-in-the-middle attacker swap a verified package and run code as root.²⁶
• Fixed APT versions are out for Debian and Ubuntu; Ubuntu 22.04 LTS and newer are affected by default.²⁴
• Exploitation needs HTTP traffic, a redirect and a retried download; Ubuntu says HTTPS protects against it.²

The Hacker News reports that a flaw in APT, the package manager for Debian and Ubuntu, lets an attacker who can modify package downloads swap a checked package for their own, which then runs as root.¹ The flaw is tracked as CVE-2026-109518 and was reported by Max Justicz.²⁶ Debian's advisory summary says APT can merge two different package downloads after an HTTP redirect gives them the same URI, and that improper file handling when resuming an HTTP download lets a man-in-the-middle attacker replace a package after verification.⁶ Debian and Ubuntu published their advisories on 4 November 2026.³⁵⁶

Ubuntu says the attacker needs to be on the path, able to manipulate HTTP traffic between the APT client and the archive server, and that a malicious mirror can exploit the flaw in the same way.² It says the flaw sits in the HTTP backend used by the APT library, so it affects any APT-based frontend, and that it can only be exploited when the system tries to install a .deb package.² Ubuntu says the archive signature scheme normally protects against this kind of attack, but the flaw lets an attacker trick APT into installing a package even if it fails signature verification.² The attack also requires a non-zero Acquire::Retries setting, which Ubuntu says is only set by default on Ubuntu 22.04 LTS and newer, with older releases affected only if it has been set.² Cyber Security News reports that the same default applies from Debian 12.⁷ A note from APT's developers, quoted in an oss-security post, says many user scripts may have set the option on older releases anyway.⁸

The Debian Security Tracker lists Debian 12 (bookworm) as fixed in APT 2.6.2 via DLA-4880-1 and Debian 13 (trixie) as fixed in 3.0.4 via DSA-6607-1.⁴ It lists forky as still vulnerable at 3.3.5 and unstable (sid) as fixed in 3.3.6.⁴ The same Debian updates also address several out-of-bounds access issues.⁵⁶ Ubuntu lists fixes of 3.3.3ubuntu0.1 for 26.10, 3.2.1ubuntu0.1 for 26.04 LTS, 2.8.4ubuntu0.1 for 24.04 LTS and 2.4.15ubuntu0.1 for 22.04 LTS, with fixes for 20.04 LTS and older available through Ubuntu Pro.³ Ubuntu rates the flaw High, with a CVSS 4.0 base score of 7.7.² The Hacker News reports that APT's developers call it critical, and that they have published a fixed version, 2.2.5, for Debian 11, whose long-term support has ended.¹

Ubuntu says HTTPS protects against the flaw because exploitation requires HTTP traffic, and that setting Acquire::Retries to zero while installing the update mitigates it.² It also says systems with unattended-upgrades enabled should receive the patches within 24 hours of release.² The Hacker News says none of the three advisories it reviewed offer a workaround or say whether HTTPS package sources are exposed, which differs from Ubuntu's blog post.¹² The Hacker News and Cyber Security News both report no attacks exploiting the flaw so far.¹⁷ Phoronix noted that, at the time of writing, the full report had not been made public.⁶

Why it matters: Ubuntu says package signature checking is what normally stops unsigned code reaching systems, and this flaw lets an attacker get past it to run code as root, so unpatched Debian and Ubuntu systems that fetch packages over HTTP remain exposed until updated.²