A critical flaw in APT, the package manager used by Debian and Ubuntu, could allow an attacker to replace a package download with a malicious file and run code as root. The vulnerability, tracked as CVE-2026-109518, was detailed in advisories published by Debian, Ubuntu and APT’s developers on November 4.
The attack relies on APT retrying a failed download, a setting enabled by default in Debian 12 and later and Ubuntu 22.04 and later. According to APT’s developers, an attacker who can alter HTTP traffic between a system and its package server could use redirects and temporary server errors to trigger retries and substitute a package.
Debian has published fixed APT versions. Ubuntu has also released updated builds for Ubuntu 26.10, 26.04 LTS, 24.04 LTS and 22.04 LTS. Ubuntu rates the issue as high priority and assigns it a CVSS 4.0 score of 7.7. Its advisory says Debian- and Ubuntu-based distributions are also affected, without naming them.
Older releases, including Debian 11 and Ubuntu 20.04, are not vulnerable by default, according to Ubuntu. However, APT’s developers warn that scripts may have enabled the Acquire::Retries setting on those systems. A fixed APT version, 2.2.5, has been published for Debian 11.
Ubuntu said its Ubuntu Pro subscribers can obtain a fix for Ubuntu 14.04. The advisories did not describe any known exploitation or provide a workaround for systems that cannot be updated. They discuss attacks over HTTP but do not say whether package sources accessed over HTTPS are affected. Max Justicz reported the vulnerability.
Sources: The Hacker News.