CVE-2026-109518, a flaw in APT, the package manager of Debian and Ubuntu, was fixed on November 4, 2026. The flaw let an attacker positioned on the network swap an already verified package for a different, malicious one and gain code execution as root during installation. Debian published advisory DSA-6607-1 and Ubuntu published USN-8996-1, both on the same day.
The problem lies in APT's download-retry logic. When a download is interrupted and retried, APT can resume the file in a way that allows the verified package to be substituted. To do that, the attacker must be able to manipulate the HTTP traffic between the machine and the package mirror — for example by controlling a malicious mirror, a proxy or another point on the network path — and force retries with HTTP redirects and transient server errors. The stated cause is hard-link reuse: the fix, a single line from APT maintainer Julian Andres Klode, makes the download methods open their target files exclusively.
Who is affected
CVE-2026-109518 affects, in the default configuration, Debian 12 and Debian 13 and Ubuntu 22.04 LTS onward. The reason is the Acquire::Retries setting, which defines how many times APT retries a failed download: the default is 3 since APT 2.3.2, and older releases such as Debian 11 and Ubuntu 20.04 are not affected in the default configuration. The flaw was reported by security researcher Max Justicz — the same researcher who, in January 2019, published a remote code execution flaw in APT, CVE-2019-3462. Canonical, the CVE's issuer, scores it 7.7 (High) on CVSS 4.0; APT's maintainers describe it as critical.
Fixed versions
The fixed versions are: Debian 13 (trixie), apt 3.0.4 (DSA-6607-1); Debian 12 (bookworm), apt 2.6.2 (DLA-4880-1); and, on Ubuntu, 2.4.15ubuntu0.1 on 22.04, 2.8.4ubuntu0.1 on 24.04, 3.2.1ubuntu0.1 on 26.04 and 3.3.3ubuntu0.1 on 26.10 (USN-8996-1). APT upstream shipped the fix in version 3.3.6. Until the update is applied, setting Acquire::Retries to 0 removes the precondition for the attack. Debian 11 is out of security support — long-term support ended on August 31, 2026 — and does not receive the fix from Debian.
No known exploitation
As of disclosure, there were no reports of CVE-2026-109518 being exploited in attacks, no public proof of concept, and the flaw was not listed in CISA's Known Exploited Vulnerabilities catalog. Even so, the recommendation is to update as soon as possible, because APT is the gateway for all installed software on millions of Debian and Ubuntu systems — and in this case, the update itself was the attack vector.
Featured image: Debian Open Use Logo, via debian.org/logos. The logo is Copyright (c) 1999 Software in the Public Interest and is released under LGPLv3 or CC BY-SA 3.0.
Sources: GetRFF — APT CVE-2026-109518: a network attacker can swap a verified package; The CyberSec Guru — CVE-2026-109518: APT Download Verification Bypass Explained; Rootnotes — apt verified the package, then a retry let somebody swap it for another.
Transparency: this article was produced with the assistance of artificial intelligence, based on public posts and internet sources cited throughout the text. We recommend checking the original sources to confirm the information.
By Muse
