Debian and Ubuntu Fix CVE-2026-109518, an APT Flaw in Download Retries That Lets an On-Path Attacker Install Unverified Packages
Debian, Ubuntu and APT's developers published fixes on November 4 for CVE-2026-109518, which needs an attacker on the HTTP path and a non-zero Acquire::Retries setting.
Overview
A flaw in APT, the package manager used by Debian, Ubuntu and derivative distributions, can let an attacker who controls HTTP traffic between a client and a package server get an unverified package installed, according to The Hacker News, which says the advisories were published on November 4. The flaw is tracked as CVE-2026-109518. Max Justicz is credited with the report by the APT developers’ advisory, Ubuntu’s blog and The Hacker News.
What the advisories say
The Debian security tracker describes an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server and trick the client into installing an attacker-controlled unverified package, with remote code execution as root. It says the flaw is caused by the reuse of hard links and requires the client to follow redirects and retry downloads of package files.
The APT developers’ advisory, posted to the deity mailing list by Julian Andres Klode, lists the issue as a “critical file verification bypass” and says an attacker could use redirects and standard transient HTTP server errors to cause retries, leading APT to override existing hardlinks with a chosen payload. Ubuntu rates it High priority and gives it a CVSS 4.0 base score of 7.7. The “critical” label comes from the APT developers and the 7.7 score from Ubuntu; they are separate assessments.
The Ubuntu blog says the flaw is in the HTTP backend invoked by the APT library and affects any APT-based frontend, including apt, apt-get and aptitude. It adds that snap installs are not affected, and that FTP and other transport methods are not affected.
Who is affected
Exploitation requires a non-zero Acquire::Retries setting. According to Ubuntu’s CVE page, the value 3 is the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older releases are unaffected in a default configuration. The APT developers say the setting “has only been the default since APT 2.3.2” and that “many user scripts may have been using it in older releases”, so older systems that set it are within scope.
Fixed versions
The Debian security tracker lists these fixes:
- Debian 12 (bookworm): APT 2.6.2 (DLA-4880-1)
- trixie: APT 3.0.4 (DSA-6607-1)
- forky and sid: APT 3.3.6
The APT developers list updated stable branches 1.2.36, 1.4.12, 1.6.19, 1.8.2.4, 2.0.12, 2.2.5, 2.4.15, 2.6.2, 2.8.4, 3.0.4 and 3.2.1. According to The Hacker News, 2.2.5 is the fixed version published for Debian 11, whose long-term support ended on August 31, and Debian’s testing branch was still on vulnerable version 3.3.5 at 14:58 UTC on November 4.
For Ubuntu, the CVE page lists these fixed versions:
- 26.10: 3.3.3ubuntu0.1
- 26.04 LTS: 3.2.1ubuntu0.1
- 24.04 LTS: 2.8.4ubuntu0.1
- 22.04 LTS: 2.4.15ubuntu0.1
- 20.04 LTS: 2.0.12+esm1 (Ubuntu Pro)
- 18.04 LTS: 1.6.19+esm1 (Ubuntu Pro)
- 16.04 LTS: 1.2.36+esm1 (Ubuntu Pro, Legacy Support add-on)
- 14.04 LTS: 1.0.1ubuntu2.24+esm4 (Ubuntu Pro, Legacy Support add-on)
The Hacker News reported that Ubuntu published builds for four releases to its security archive at 14:25 UTC on November 4 and that, at 15:46 UTC, Ubuntu still marked all eight releases it tracks as vulnerable. The Ubuntu CVE page, read by the Herald on November 5, lists a fixed version for each of the eight.
Mitigations Ubuntu describes
Ubuntu’s blog says: “The use of TLS via HTTPS protects against this vulnerability, as exploitation requires the attacker to manipulate HTTP traffic.” It also says: “Temporarily setting Acquire::Retries to zero while installing this security update provides a mitigation against this vulnerability, whether exploited by an on-path attacker or a potentially malicious mirror.” It describes the sources-file change for enabling HTTPS and notes that some community mirrors do not support HTTPS.
Other items in the same APT advisory
The APT developers’ advisory also bundles fixes for several out-of-bounds memory accesses, for which it says it does not expect direct security impact beyond denial of service of third-party applications that use the affected functions on a privilege boundary. It also describes unbounded memory exhaustion in APT series 2.6, 2.8 and 3.0 when retrying delayed items. It says several out-of-bounds accesses in apt-ftparchive and one in the build-dependency parser were not fixed.
What is not established
The Hacker News says none of the three advisories describe attacks exploiting the flaw. The Herald found no cited source reporting exploitation.