Summary
- CVE-2026-109518 affects APT's handling of redirected and retried package downloads.
- An attacker controlling the HTTP traffic or a malicious mirror could bypass package verification under specific conditions.
- Debian and Ubuntu have issued fixes, with configuration and distribution version determining exposure.
Debian and Ubuntu have issued security fixes for a vulnerability in the APT package manager that could allow an attacker controlling HTTP download traffic to substitute an unauthorised software package and execute code with root privileges.
The issue, tracked as CVE-2026-109518, was discovered by security researcher Max Justicz and disclosed on 4 November.
Debian issued security advisory DSA-6607-1, while Ubuntu published a separate assessment explaining the affected configurations and available remediations.
The vulnerability concerns an interaction between HTTP redirects, resumed downloads, and the package manager’s handling of previously verified files.
Under affected conditions, APT can merge separate package downloads after a redirect gives them the same URI. Incorrect file handling during a subsequent retry can allow an attacker to replace content after an earlier verification operation.
Because Debian packages can execute installation scripts with root privileges, installing substituted malicious content can result in complete compromise of the affected system.
Download retries create the exploitation condition
APT is a central software management component of Debian-based Linux distributions. It downloads packages, processes repository metadata, and coordinates installation and maintenance.
Normal repository verification is designed to prevent unauthorised packages from being accepted, even when downloads pass through infrastructure that is not fully trusted.
The newly disclosed issue creates an exception to those protections under particular network and client conditions.
An attacker must be able to manipulate HTTP traffic between the affected APT client and a package server, including through a malicious mirror or a compromised network path. The client must also attempt a package installation involving the vulnerable download-handling behaviour.
Crucially, the exploit depends on the package manager retrying a failed download. Ubuntu identifies the Acquire::Retries setting as the configuration controlling this behaviour.
Ubuntu 22.04 LTS and newer releases use a non-zero retry setting by default. Older supported releases can also be affected where administrators or software management tools have enabled retries.
The vulnerability does not affect software installation through Snap packages, which use a different distribution and verification mechanism.
Ubuntu also confirms that HTTPS protects against this specific attack route because exploitation requires manipulation of HTTP traffic. That protection is separate from the repository signing architecture and does not replace installing the corrected APT packages.
Software maintenance becomes the entry point
APT is used across server estates, developer workstations, cloud infrastructure, and many automated deployment environments.
Package installation is normally an administrative activity that organisations depend upon to maintain software security. An attacker able to interfere with that trusted process may consequently gain privileges that would not be available through an ordinary application account.
The flaw does not establish that Debian or Ubuntu repositories were compromised. Nor does it indicate that attackers obtained legitimate repository signing keys.
Instead, the reported mechanism concerns the handling of packages by an affected client after network conditions trigger particular download and retry operations.
That distinction is important when assessing exposure. Systems using unaffected configurations, corrected APT packages, or protected transport arrangements are not exposed to the same attack path.
Administrators applying the corrected packages may need to confirm their repository transport arrangements and installed APT version, especially where automated maintenance tools modify retry settings. Those checks address exposure to the disclosed mechanism rather than suggesting that legitimate repositories have been altered.
Debian’s stable Trixie release received a fix in APT version 3.0.4. Ubuntu published corrected packages for affected supported releases, although its initial advisory still listed the Ubuntu 26.10 update as being published.
Both distributions recommend installing the relevant security updates. Ubuntu also documents a temporary mitigation involving the disabling of automatic download retries during remediation.
The available advisories describe a potentially serious route to root-level compromise but do not establish widespread exploitation before disclosure.
