Debian and Ubuntu have released fixes for CVE-2026-109518, a critical flaw in the APT package manager that lets an attacker who can alter HTTP traffic replace a verified package with their own, which then installs with root rights. Millions of servers and cloud hosts use HTTP package sources by default, though no exploitation or public exploit code has been reported.
How CVE-2026-109518 Lets an On-Path Attacker Replace a Verified Package
The vulnerability affects APT, the package manager behind apt, apt-get and aptitude on Debian, Ubuntu and their derivatives. An attacker positioned between APT and a package server, such as an on-path attacker, a rogue mirror or a malicious proxy, can swap a verified package for a payload of their choosing. APT then installs it as root.
The attack works by forcing APT to retry a failed download. The attacker uses HTTP redirects and ordinary temporary server errors to push the client into its retry path, where the verification protection breaks down.
Retry Defaults in Debian 12 and Ubuntu 22.04 Widen Exposure
Retries are enabled by default starting with Debian 12 and Ubuntu 22.04. Older releases, including Debian 11 and Ubuntu 20.04, are not exposed in their default configuration. Systems on those releases can still be vulnerable if scripts or configuration files set the Acquire::Retries option.
APT Advisories Disagree on Whether HTTPS Sources Are Exposed
Max Justicz reported the flaw. One source states that HTTPS and FTP sources, along with snap packages, are safe from an on-path attacker. Another says the advisories themselves do not specify whether HTTPS sources are exposed. The reports differ, and the advisories leave the question open.
Debian Calls It Critical While Ubuntu Rates It High
Debian advisory APT-2026-11-01 was posted by maintainer Julian Andres Klode, who rated the issue critical. Ubuntu classed it as high priority with a CVSS 4.0 score of 7.7. The same update also fixes several out-of-bounds memory bugs and a memory drain issue.
Ubuntu and Debian APT Patch Rollout Was Uneven on Disclosure Day
Distribution trackers showed gaps within hours of publication. Ubuntu pushed fixed APT packages for four releases at 14:25 UTC. At 15:46 UTC, however, all eight tracked Ubuntu releases, from 14.04 to 26.10, still appeared as vulnerable in the tracker. Debian testing remained on the vulnerable 3.3.5 build at 14:58 UTC.
Fixed APT versions are available, including 2.2.5 for Debian 11, whose long-term support ended on 31 August, and Ubuntu Pro builds that reach back to 14.04. No workaround exists for systems that cannot update.
Why APT Package Verification Failures Reach Beyond a Single Host
APT sits at the start of nearly every software installation and update on affected systems, and it typically runs with root privileges. A flaw that defeats its signature verification during a retry therefore turns any network position along the download path into a route to full control of the machine. Cloud images and container build pipelines that fetch packages over plain HTTP from mirrors or proxies fall into the same category as individual servers.
The practical exposure depends on where the attacker can sit. A rogue or compromised mirror or an on-path position requires some prior foothold or control of network infrastructure, which separates this flaw from remotely exploitable bugs in listening services. Even so, the combination of default retry behavior, a long-supported installed base and root-level impact explains the critical rating on the Debian side.
With no workaround published, administrators of end-of-life or slow-moving fleets have no interim control beyond the updated packages themselves. The tracker discrepancies on disclosure day also suggest that mirror and repository propagation, not just the fix itself, will determine when different Debian and Ubuntu releases actually become protected.
