Ing. Calogero Bono
On November 4, Debian, Ubuntu and the APT developers published advisories on CVE-2026-109518, a flaw in the package manager of Debian and Ubuntu. Anyone who can alter the HTTP traffic between the client and the package server can get their own unverified package installed and run code as root. Ubuntu rates it high priority, with a CVSS 4.0 score of 7.7. It matters because APT is present on servers, development machines and the infrastructure of many companies.
A few terms before we get into the facts. APT is the program that downloads and installs software packages on Debian and Ubuntu. MitM (man in the middle) refers to someone who inserts themselves into the traffic between two systems and can alter it. RCE is remote code execution. Acquire – – Retries is the APT setting that decides how many times to retry a failed download. CVSS is the scale that measures the severity of a vulnerability from 0 to 10.
What happens with the APT flaw?
According to the Ubuntu security notice, an on-path attacker can manipulate the HTTP traffic between APT and the archive server while a package is being installed. The client is thus induced to install a package controlled by the attacker, without verification, with root privileges.
The cause indicated is the reuse of hard links. The attack requires that the client follow redirects and retry the download of package files.
Who can exploit it and under what conditions?
It can be anyone able to alter the traffic between APT and the server, including a malicious mirror or proxy. This is reported by The Hacker News, citing the APT developers. The attack triggers when the computer installs a package and uses HTTP redirects and temporary server errors to force retries.
It therefore requires an Acquire – – Retries value other than zero. The value 3 is the default in Debian 12 and in Ubuntu 22.04 LTS onward.
Which Debian and Ubuntu versions are affected?
The older releases, such as Debian 11 and Ubuntu 20.04, are not exposed in the default configuration, Ubuntu says. The APT developers warn, however, that many user scripts may have enabled the retry parameter anyway.
Ubuntu lists as vulnerable all eight releases it covers, from 14.04 LTS to 26.10. Derived distributions are also involved, but none is named. If you use a derivative, check its security advisory.
Are updates already available?
Debian has released fixed versions of APT. For Debian 11, whose long-term support ended on August 31, the developers have published version 2.2.5. Debian's testing branch was still at the vulnerable 3.3.5 at 14:58 UTC on November 4.
Ubuntu published new builds for four releases at 14:25 UTC.
- Ubuntu 26.10, 3.3.3ubuntu0.1
- Ubuntu 26.04 LTS, 3.2.1ubuntu0.1
- Ubuntu 24.04 LTS, 2.8.4ubuntu0.1
- Ubuntu 22.04 LTS, 2.4.15ubuntu0.1
At 15:46 UTC the Ubuntu notice still marked all releases as vulnerable. Those with Ubuntu Pro can already get an update for 14.04.
Limits to know
The advisories do not describe ongoing attacks and do not offer workarounds for those who cannot update. They talk about attacks over HTTP and do not clarify whether sources reached via HTTPS are exposed. We do not know which derivatives are affected. The status of the releases may change as fixes come out.
What changes for those working with digital systems
If you manage Debian or Ubuntu servers, the priority is to update APT as soon as the fixed package arrives for your release. Check where your systems download packages from, because an untrusted mirror or proxy becomes a concrete risk. Also review scripts and configurations that set Acquire – – Retries. If you use managed hosting and servers, it is worth asking your provider when and how they apply the patch. For the basics of package managers, see our guide to apt, dnf and pacman.
Our take
Package signing is the foundation of trust in APT, and this flaw shows that a file-handling defect can bypass it. It affects the default behavior of recent releases, not a rare configuration. The mismatch seen on November 4 also weighs heavily, with advisories published while many releases were still vulnerable. System administrators need clear instructions, especially for versions out of support. It remains hard to understand why none of the three advisories offers a temporary workaround.
Frequently asked questions
How does the attack on APT work?
The attacker alters the HTTP traffic between APT and the package server. They use redirects and temporary errors to make the download retry and replace the verified package with their own.
Are Debian 11 and Ubuntu 20.04 safe?
Not for certain. In the default configuration they are not exposed, but if Acquire – – Retries was enabled by scripts or settings, the risk exists. For Debian 11, version 2.2.5 is available.
How serious is CVE-2026-109518?
Ubuntu rates it high priority, with CVSS 4.0 of 7.7. The APT developers call it critical. The possible outcome is code execution as root.
Is there a temporary workaround?
Not according to the sources. The three advisories do not indicate workarounds for systems that cannot update.
Who already has the patch?
Debian has released fixed versions. Ubuntu has published builds for 22.04, 24.04, 26.04 and 26.10, while Ubuntu Pro already has an update for 14.04.
What to check in the coming days on APT patches
The situation is still changing, with fixed releases only partially available. It is wise to follow the official advisories of your distribution.
- Check the Ubuntu security page and Debian advisories until your release is shown as fixed.
- Verify the installed APT version and compare it with those listed for your release.
- If you use a Debian or Ubuntu derivative, look for its specific advisory, since the sources do not name any.
