A critical vulnerability named CVE-2026-109518 has been discovered in APT, the package manager used by Debian and Ubuntu. The flaw enables attackers positioned between a user and update servers—such as on public Wi-Fi or via malicious mirrors—to swap authentic packages for malicious ones and execute code with root privileges. The bug was responsibly reported by researcher Max Justicz and officially acknowledged by Debian on November 4, 2026.
How the Flaw Works
The vulnerability arises from how APT verifies package integrity. Normally, downloaded packages are checked against signed data to ensure authenticity. However, if a download is interrupted and then resumed, APT may merge two separate downloads—one prior to verification and another potentially malicious version served after a redirect. Due to this behavior, an attacker can replace a properly verified package with a corrupted or malicious one.
Key prerequisites for the attack include network access between the user and the archive server (e.g. via a rogue proxy, compromised mirror, or local MITM), following HTTP redirects, and attempting a retry of the download. The vulnerability also hinges on hard link reuse, which can be manipulated to bolster the attack vector.
Who’s Affected and What’s Been Fixed
Systems running Debian 12 (bookworm), Ubuntu 22.04 LTS, and newer versions with default retry settings are vulnerable. The default setting for `Acquire::Retries`, which handles interrupted downloads, is 3 on both Debian 12 and Ubuntu 22.04, leaving them exposed. Older releases with retries disabled by default are not affected unless this setting has been changed.
Debian has released patched versions: bookworm’s APT has been updated from version 2.6.1 (vulnerable) to 2.6.2 (fixed); Trixie is updated from 3.0.3 to 3.0.4; testing/unstable cycled through similar fixes. The upstream APT 3.3.6 release also modifies download routines to open target files exclusively—preventing two downloads from touching the same file—and blocks DEB packages missing a required Version field. A sorting bug in the dependency resolver has also been addressed.
What Users Should Do Now
Administrators and users should immediately confirm whether their system’s APT version matches a fixed release. Until patches are applied, it’s advisable to set `Acquire::Retries` to 0 to disable automatic retries—though this may impact update resilience on lossy networks. Using HTTPS mirrors reduces risk by making interception and redirect attacks significantly harder.
There is no evidence yet of active exploitation. Nonetheless, given the high stakes—update systems run with full trust and a single compromised package could lead to full system breach—updating now is the safest bet. Vendors distributing derivatives of Debian or Ubuntu should monitor advisories and apply fixes promptly.
Understanding supply-chain risks has become critical. This flaw underscores that the security of update tools—especially redirect handling, download resumption, and package verification—is as vital as the software they install.
What this means: root-level vulnerabilities via package managers are among the most dangerous kinds, since they undermine trust at the foundation of system integrity. Keep an eye on vendor-specific advisories, emergency patches, and whether extended support releases also receive timely fixes. For organizations, consider auditing systems for misconfigurations (like non-zero retries) and ensuring update paths are as locked down as possible.
