A critical vulnerability in the APT package manager for Debian and Ubuntu has been disclosed, allowing attackers to potentially execute code as root by swapping verified packages with malicious ones. This flaw, identified as CVE-2026-109518, was detailed in advisories from Debian, Ubuntu, and APT’s developers on November 4, 2026. The vulnerability is particularly concerning as it exploits the default behavior of APT to retry failed downloads, a feature enabled from Debian 12 and Ubuntu 22.04 onwards.
According to the advisories, the flaw allows an attacker who can manipulate package downloads to replace legitimate packages with their own code, which then executes with root privileges. Debian has already released patched versions of APT, while Ubuntu is in the process of rolling out updates across its various distributions, including Ubuntu Pro for users of version 14.04.
Details of the Vulnerability
The vulnerability affects multiple versions of APT, with Debian’s testing branch still running the vulnerable version 3.3.5 as of the advisory’s release. For Debian 11, which reached the end of its long-term support on August 31, a fixed version 2.2.5 has been published. Ubuntu has rated the flaw as high priority, assigning it a CVSS score of 7.7, indicating significant risk. Additionally, distributions built on Debian and Ubuntu are also considered at risk, although specific names were not disclosed.
Exploitation Mechanics
Attackers can exploit this vulnerability by altering HTTP traffic between APT and the package server, which could involve a malicious mirror or proxy. The attack is triggered when a user attempts to install a package, with the attacker leveraging HTTP redirects and temporary server errors to force APT to retry the download. This method allows the attacker to substitute a legitimate package with a malicious one without the user’s knowledge.
Max Justicz, who reported the flaw, noted that the advisories do not provide any evidence of active exploitation or specific workarounds for systems unable to update immediately. The advisories also do not clarify whether package sources accessed via HTTPS are vulnerable, leaving some uncertainty regarding the security of encrypted connections.
Next Steps for Users
Users of affected Debian and Ubuntu systems are strongly advised to update their APT installations as soon as possible to mitigate the risk posed by this vulnerability. While older releases like Debian 11 and Ubuntu 20.04 are not exposed by default, user configurations may inadvertently enable the retry setting, increasing the risk of exploitation.
For further details, users can refer to the advisories published by Debian and Ubuntu.
