An attacker who can modify traffic between APT and the package server can replace a verified download with their own package and execute its code as root. The flaw, identified as CVE-2026-109518, affects Debian and Ubuntu and requires APT to retry a failed download: this retry is enabled by default starting with Debian 12 and Ubuntu 22.04.
Advisories from Debian, Ubuntu, and the APT developers were published on November 4, according to The Hacker News. Debian had already released fixed versions, while Ubuntu classified the issue as high priority and published new builds for several of its releases. The difference between the availability of those packages and the status still reflected in Ubuntu's advisories was part of a response that was still ongoing.
A download that can be replaced during a retry
The attack does not simply involve delivering a fake package and waiting for APT to accept it. According to the APT developers, the attacker uses HTTP redirects and ordinary temporary server errors to force the package manager to retry the download. If they can alter traffic between APT and the package server, they can exploit that process to replace the verified package with one they control.
Ubuntu notes that the attacker could be anyone capable of modifying that traffic, including a malicious mirror or proxy. The attacker's code runs when the machine installs a package. Since APT performs that operation with root privileges, the result can be code execution with the system's highest level of permissions.
The vulnerability affects a core tool in Debian and Ubuntu: APT manages package installation and updates in both distributions. RedesZone warns that the potential scope also includes derivative systems and devices that use APT, from servers to desktop computers and embedded devices. Ubuntu also indicates that distributions built on Debian and Ubuntu are affected, although it does not identify them by name.
The retry setting determines exposure
The behavior required for the attack is enabled by default in Debian 12 and later versions, and in Ubuntu 22.04 and later, The Hacker News reports. Earlier versions, including Debian 11 and Ubuntu 20.04, are not exposed by default, according to Ubuntu. However, the APT developers warn that user scripts may also have enabled the Acquire::Retries configuration option in those versions.
Therefore, the reference to older versions does not mean that all of them are safe under every configuration. The condition described by the developers is that APT retries a failed download; if a script has enabled that option, the behavior can also occur on earlier systems. The sources do not detail which specific configurations users have adopted or how many machines are exposed.
Ubuntu assigned the flaw a CVSS 4.0 score of 7.7 and classified it as high priority. The Hacker News says the APT developers rated it critical. The vulnerability is therefore not limited to an application that processes data with ordinary permissions: its risk stems from the fact that malicious code can run during package installation, with the package manager's privileges.
Fixed Debian versions and Ubuntu builds
Debian released fixed versions of APT for CVE-2026-109518. The Hacker News also reports that the APT developers released a fixed version, 2.2.5, for Debian 11, whose long-term support period ended on August 31. Debian's testing branch was still using the vulnerable version 3.3.5 at 14:58 UTC on November 4.
Ubuntu published new builds in its security archive at 14:25 UTC on November 4. The versions listed by The Hacker News are 3.3.3ubuntu0.1 for Ubuntu 26.10, 3.2.1ubuntu0.1 for Ubuntu 26.04 LTS, 2.8.4ubuntu0.1 for Ubuntu 24.04 LTS, and 2.4.15ubuntu0.1 for Ubuntu 22.04 LTS.
The availability of builds did not mean that the status of every version was updated immediately. At 15:46 UTC, Ubuntu still marked all eight versions it tracked for the flaw as vulnerable, from Ubuntu 14.04 LTS through 26.10. The release of packages and the updating of advisories are separate events; the information reported by Ubuntu reflected that difference on November 4.
For Ubuntu 14.04, users with an Ubuntu Pro subscription could already obtain an update, according to The Hacker News. The APT developers added that updates were being published for Ubuntu and the Ubuntu Pro service. That information does not detail all the fixed package versions for the other Ubuntu releases.
The advisories disagree on the status of the fix
RedesZone, in a report published on November 5, noted that an official bulletin from Debian or Canonical identifying the vulnerability or the fixed APT version had not yet been published. The Hacker News, in contrast, reported on the November 4 advisories, the CVE-2026-109518 identifier, the Debian versions already fixed, and the Ubuntu builds. It also noted that Ubuntu was still listing its eight tracked versions as vulnerable at 15:46 UTC.
Given this discrepancy, the specific information on package status is that which The Hacker News attributes to Debian, Ubuntu, and the APT developers: Debian released fixes and Ubuntu made new builds available in its security archive, although its advisories still listed versions as vulnerable at the time indicated. RedesZone recommended checking Debian's DSA and Ubuntu's USN advisories and applying the update when it appeared there.
RedesZone also advised avoiding Debian or Ubuntu updates over public or untrusted networks until a confirmed fix is available, maintaining the usual repository integrity checks, and not installing standalone packages from another distribution to get ahead of the patch. That last practice can break dependencies and leave the system in a worse state, the outlet warns.
The publications consulted do not describe attacks that have already exploited the flaw or offer a workaround for systems that cannot yet be updated. They also describe the attack over HTTP, but do not clarify whether package sources accessed over HTTPS are exposed. RedesZone recommends following the official advisories and checking which fixed version applies to each distribution.
Sources: RedesZone, The Hacker News
