The tool that installs almost every piece of software on Debian, Ubuntu and their derivatives could be tricked into installing a package nobody had verified, and running it as root. Debian and Canonical shipped fixes for the flaw, CVE-2026-109518, in the APT package manager on 4 November.
The bug was found by researcher Max Justicz, who is credited in both the Debian security advisory DSA-6607-1 and Canonical's Ubuntu security notice USN-8996-1. Canonical's CVE record credits Julian Andres Klode with developing the fix.
The attacker has to be in the middle
This is not a flaw anyone on the internet can fire at a server. The attacker needs to sit on the network path between a machine and its package archive and be able to tamper with the HTTP traffic, which Canonical says includes running a malicious mirror or proxy. From that position, during a package install, the attacker can get APT to install an attacker-controlled package that never passed verification, leading to code execution with root privileges.
Debian's advisory describes the mechanism in two parts. APT can merge two different package downloads when an HTTP redirect gives them the same URI, and improper file handling when an HTTP download is resumed lets a man-in-the-middle replace a package after it has been verified. Canonical's record attributes the bug to the reuse of hard links (a second filename pointing at the same file on disk).
Canonical scores it 7.7 (High) under CVSS 4.0. Neither advisory reports exploitation in the wild.
A retry setting decides who is exposed
The attack only works when APT follows redirects and retries package downloads, which requires the Acquire::Retries setting to be non-zero. According to Canonical's CVE record, a value of 3 became the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS, so older releases are unaffected in a default configuration. A post to the oss-security mailing list forwarding the Debian advisory notes the default arrived with APT 2.3.2 and that older systems may still have retries switched on by their own scripts.
Update APT, or set Acquire::Retries to 0
Fixed versions published so far:
- Debian 13 (trixie): apt 3.0.4, which also fixes several out-of-bounds memory access issues
- Ubuntu 26.10: apt 3.3.3ubuntu0.1
- Ubuntu 26.04 LTS: apt 3.2.1ubuntu0.1
- Ubuntu 24.04 LTS: apt 2.8.4ubuntu0.1
- Ubuntu 22.04 LTS: apt 2.4.15ubuntu0.1
- Ubuntu 20.04, 18.04, 16.04 and 14.04 LTS: fixes available through Ubuntu Pro
For other Debian releases, Debian points to its security tracker for the apt package. Until a system is upgraded, adding Acquire::Retries "0"; to the APT configuration may mitigate the issue, according to the advisory text posted to oss-security.
Peru's National Digital Security Center also flagged the fix in its integrated digital security alert 219-2026, alongside the OpenSSH flaw that let attackers log in on some Linux builds earlier this week.
Both bugs sit in plumbing that Linux fleets trust by default. Package signing is only as strong as the guarantee that the file APT checked is the file it installs, and for a few years of default configurations that guarantee had a gap.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.