Debian and Ubuntu machines: an APT flaw lets a network attacker swap in a package that runs as root. Update APT first

APT, the tool that installs software on Debian and Ubuntu, has a flaw that lets someone sitting in the network path swap a package after APT has checked its signature. The swapped package then installs, and its scripts run as root.

Fixed APT builds shipped on November 4 for every supported Debian and Ubuntu release. Most servers will pick them up through their normal update job. The ones to worry about pull packages over plain HTTP from a mirror or proxy you do not control.

APT checks the package signature, then a retried download lets an attacker swap the file. Update APT before anything else.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

APT can be tricked into installing a swapped package

Max Justicz found the bug, tracked as CVE-2026-109518. Debian’s advisory DSA-6607-1 says APT can merge two different package downloads after an HTTP redirect gives them the same address, and that the way it resumes an interrupted download lets an attacker in the middle replace a package after verification.

Ubuntu rates it high, with a CVSS 4.0 score of 7.7. The attack only works when APT is set to retry failed downloads. The setting, Acquire::Retries, has defaulted to 3 since Debian 12 and Ubuntu 22.04, so those releases and everything newer are exposed out of the box.

• Debian 13 (trixie): fixed in apt 3.0.4. Debian 12 (bookworm): fixed in 2.6.2.
• Ubuntu 26.10: 3.3.3ubuntu0.1. Ubuntu 26.04 LTS: 3.2.1ubuntu0.1. Ubuntu 24.04 LTS: 2.8.4ubuntu0.1. Ubuntu 22.04 LTS: 2.4.15ubuntu0.1.
• Ubuntu 20.04 and older: fixed builds through Ubuntu Pro (ESM), for systems that set retries themselves.

Debian 12, Ubuntu 22.04 and newer retry downloads by default

The attacker has to control the HTTP traffic between a machine and its package server. Ubuntu names a malicious mirror or proxy as examples. Inside a data center that is a short list. For laptops that update on hotel Wi-Fi, build runners behind a shared caching proxy, or servers pointed at a small community mirror, it is longer.

Ubuntu says package sources reached over HTTPS are protected, because the attacker needs to alter plain HTTP traffic. Snap installs use a different system and are not affected. Neither Debian nor Ubuntu reports attacks.

Update APT itself first, with retries switched off

• Install the fixed APT with retries turned off for that one run, as Ubuntu recommends: sudo apt update && sudo apt install -o Acquire::Retries=0 --only-upgrade '?source-package(^apt$)'. On Debian, sudo apt-get -o Acquire::Retries=0 install --only-upgrade apt does the same job.
• Check the result with apt list --installed '?source-package(^apt$)' and compare against the versions above.
• Switch Ubuntu archive entries in /etc/apt/sources.list and /etc/apt/sources.list.d/ from plain HTTP to HTTPS. Test with apt update, because some community mirrors do not serve HTTPS.
• Rebuild container base images and golden VM images so new machines do not start on the old APT.
• Sorting this week’s Linux updates against everything else? Our patch priority checklist puts exposed systems first.

Details

• CVE-2026-109518: APT HTTP backend. Hard-link reuse when resuming a redirected download lets an on-path attacker replace a verified .deb. Needs a non-zero Acquire::Retries (default 3 since APT 2.3.2). CVSS 4.0 7.7 (AV:N/AT:P/PR:N/UI:P), per Ubuntu.
• Advisories: Debian DSA-6607-1 (trixie, 3.0.4; the same update fixes several out-of-bounds access bugs) and DLA-4880-1 (bookworm, 2.6.2); Ubuntu USN-8996-1, published November 4.
• Mitigation until patched: Acquire::Retries 0; in apt.conf, or HTTPS package sources. FTP sources are not affected, Ubuntu says.
• Exploitation: none reported by Debian or Ubuntu as of November 4.

Hunt / verify

• List machines whose package sources still use plain HTTP: grep -rn "http:" /etc/apt/sources.list /etc/apt/sources.list.d/.
• Find any proxy set for APT with apt-config dump | grep -i proxy, and confirm you own it.
• In /var/log/apt/history.log and term.log, look for packages nobody on your team asked for, especially on machines that update through a shared proxy.

Source: Ubuntu APT fix guide; Debian DSA-6607-1

Sources

• Debian: DSA-6607-1 apt security update (November 4, 2026)
• Debian security tracker: CVE-2026-109518
• Ubuntu: CVE-2026-109518 APT vulnerability fixes available
• Ubuntu: CVE-2026-109518
• Ubuntu: USN-8996-1
• oss-security: CVE-2026-109518: RCE in apt(1) (DSA 6607-1)
• The Hacker News: Debian and Ubuntu APT Flaw Lets MitM Attackers Swap Verified Packages and Run Code as Root
• CVE.org: CVE-2026-109518

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].