Debian and Ubuntu Fix APT Flaw That Lets Tampered Downloads Run as Root

Debian and Ubuntu published fixes on 4 November 2026 for CVE-2026-109518, a flaw in APT, the package manager for Debian and Ubuntu. An attacker who can manipulate HTTP traffic between a machine and its package source can get the machine to install an unverified, attacker-controlled package, which runs with root privileges.

The Hacker News reported the issue the same day and said none of the three advisories describes attacks exploiting it.

What the Flaw Does

Ubuntu’s CVE page and the Debian security tracker describe the same mechanism. The flaw stems from reused hard links and requires the client to follow redirects and retry package downloads. The result is remote code execution with root privileges.

The attacker must sit on the path between APT and the archive server. Both trackers say the malicious traffic can come from a rogue mirror or proxy, and that the attack runs while a package is being installed.

Only clients with a non-zero Acquire::Retries setting are affected. Both trackers say the default value of 3 applies from Debian 12 and Ubuntu 22.04 LTS onward, so older releases are not exposed in a default configuration.

The Hacker News, citing the advisories, reported that the attacker uses HTTP redirects and ordinary temporary server errors to force the retries. It also said the advisories describe the attack over HTTP and do not say whether HTTPS sources are exposed.

Version check
Ubuntu’s CVE page gives fixed apt versions of 2.4.15ubuntu0.1 for 22.04 LTS and 2.8.4ubuntu0.1 for 24.04 LTS; Debian’s tracker gives 2.6.2 for bookworm and 3.0.4 for trixie.

Severity and Older Releases

Ubuntu rates the issue high priority with a CVSS 4.0 score of 7.7. The vector on its page lists a network attack vector, low attack complexity, no privileges required and high impact on confidentiality, integrity and availability of the vulnerable system. The Hacker News reported that APT’s developers call the flaw “critical.”

Debian 11 and Ubuntu 20.04 are not exposed by default, according to Ubuntu. The Hacker News reported that APT’s developers note many user scripts may have enabled Acquire::Retries on those releases, which would make them vulnerable.

Ubuntu says distributions built on Debian and Ubuntu are also affected, without naming any.

Which Versions Are Fixed

Ubuntu lists fixed apt packages for each release: 3.3.3ubuntu0.1 for 26.10, 3.2.1ubuntu0.1 for 26.04 LTS, 2.8.4ubuntu0.1 for 24.04 LTS and 2.4.15ubuntu0.1 for 22.04 LTS. Fixes for 20.04 LTS (2.0.12+esm1) and 18.04 LTS (1.6.19+esm1) are available through Ubuntu Pro.

Fixes for 16.04 LTS (1.2.36+esm1) and 14.04 LTS (1.0.1ubuntu2.24+esm4) come through the Ubuntu Pro Legacy Support add-on. Ubuntu’s notice for the update is USN-8996-1.

The Debian tracker lists apt 2.6.2 for bookworm, replacing the vulnerable 2.6.1, and 3.0.4 for trixie, replacing 3.0.3. Both come through the security archive. Debian’s forky and sid releases are fixed in 3.3.6. The tracker points to advisories DLA-4880-1 for bookworm and DSA-6607-1 for trixie.

The Hacker News said Debian 11’s long-term support ended on 31 August and that APT’s developers published version 2.2.5 for it. It also reported that Debian’s testing branch was still on a vulnerable version, 3.3.5, at 14:58 UTC on 4 November.

Only clients with a non-zero Acquire::Retries setting are affected, and the default of 3 applies from Debian 12 and Ubuntu 22.04 LTS onward.

What It Means for Small Businesses

Servers that pull updates over plain HTTP, or through a mirror or proxy the business does not control, meet some of the conditions the advisories describe; the attack also requires a non-zero Acquire::Retries setting. The Hacker News reported that the advisories offer no workaround for systems that cannot update yet.

The Hacker News reported that Max Justicz is credited with reporting the flaw.

The Hacker News reported that APT’s developers say updates for Ubuntu and its Ubuntu Pro subscription service are being released. At 15:46 UTC on 4 November, it said, Ubuntu still listed all eight tracked releases, from 14.04 LTS to 26.10, as vulnerable. Debian’s tracker lists 3.3.6 as the fixed version for forky and sid.

Administrators can check their installed apt version against the fixed versions published by Debian and Ubuntu.