A flaw in APT affects Debian and Ubuntu package downloads when an attacker can alter traffic between the package manager and the package server. The issue lets a checked package be replaced during a retry, and the attacker’s code can run as root.
Advisories from Debian, Ubuntu, and APT’s developers were published on November 4. APT retries failed downloads by default from Debian 12 and Ubuntu 22.04 onward, which creates the condition the attack depends on.
APT Retry Abuse on Debian Systems
The flaw has the identifier CVE-2026-109518. Debian has already released fixed APT versions for it, and APT’s developers describe the issue as critical. Ubuntu says updates for Ubuntu and its Ubuntu Pro subscription service are being released, and Ubuntu 14.04 users with Ubuntu Pro can already get one.
Debian 11 and Ubuntu 20.04 are described as not exposed by default. Even so, APT’s developers say many user scripts may have enabled the retry setting, Acquire::Retries, on those releases. Debian’s testing branch was still on version 3.3.5 at 14:58 UTC on November 4, while Debian 11 has a fixed version, 2.2.5, after its long-term support ended on August 31.
Ubuntu Release Coverage and Status
Ubuntu rates the flaw high priority and gives it a CVSS 4.0 score of 7.7. It also says distributions built on Debian and Ubuntu are affected, but it does not name any of them. At 14:25 UTC on November 4, Ubuntu had published new APT builds for four releases in its security archive.
| Ubuntu 26.10 | 3.3.3ubuntu0.1 |
|---|---|
| Ubuntu 26.04 LTS | 3.2.1ubuntu0.1 |
| Ubuntu 24.04 LTS | 2.8.4ubuntu0.1 |
| Ubuntu 22.04 LTS | 2.4.15ubuntu0.1 |
At 15:46 UTC, Ubuntu still marked all eight releases it tracks, from 14.04 LTS to 26.10, as vulnerable.
How the Attack Works
The attacker can be anyone able to change HTTP traffic between APT and the package server, including a malicious mirror or proxy. The attack runs while the computer installs a package. HTTP redirects and ordinary temporary server errors can be used to force APT to retry the download.
Reporting and Open Questions
Max Justicz reported the flaw. None of the three advisory reports describe active exploitation or give a workaround for systems that cannot update yet. They describe the attack over HTTP and do not say whether package sources reached over HTTPS are exposed.
Licensed under CC BY-ND 4.0 International