CVE-2026-109518: Debian APT flaw lets attackers run root code

Updated 4 November, 20:49 UTC. Ubuntu released fixes, says 22.04 and newer are affected by default, and gives two ways to block the attack until patched.

Debian has fixed a flaw in APT, the tool that installs and updates software on Debian and the Linux systems built on it, that lets an attacker who can intercept a machine's traffic replace a package after APT has checked it and run code as root. Debian said in its advisory on 4 November that the bug, CVE-2026-109518, was found by Max Justicz, a researcher who has previously reported remote code execution flaws in package tools and registries including RubyGems, Packagist, Alpine's apk and CocoaPods.

APT checks package signatures so that a tampered download is rejected. This bug lets the swap happen after that check. According to Debian, APT can merge two different package downloads when an HTTP redirect gives them the same address, and it mishandles files when it resumes an interrupted HTTP download. A man-in-the-middle can use this to swap the package after verification. The fix in the apt changelog is one line, "Open target files exclusively", International Cyber Digest noted. The same update also fixes several out-of-bounds memory bugs, Debian says.

Second APT flaw from the same researcher

Justicz found a similar APT bug in 2019, CVE-2019-3462, which also let a man-in-the-middle or a malicious mirror run code as root through APT's handling of HTTP redirects, as he described in his write-up at the time. His advice then was to update with redirects turned off. Neither Debian's advisory nor Ubuntu says the new flaw has been exploited.

Ubuntu is affected too

Canonical released fixes on 4 November for every affected Ubuntu release and rates the flaw High, with a CVSS 4.0 score of 7.7. Ubuntu 22.04 LTS and newer are affected by default. Older releases are affected only if APT is set to retry failed downloads, because the attack needs a retried download, and that setting (Acquire::Retries) is non-zero by default only from 22.04 on. The fixed versions include apt 2.4.15ubuntu0.1 for 22.04, 2.8.4ubuntu0.1 for 24.04 and 3.2.1ubuntu0.1 for 26.04, and Canonical lists the rest in its post. Canonical also says a malicious package mirror could use the flaw to deliver unsigned packages, and that snap packages are not affected.

Until the update is installed, Canonical names two ways to block the attack: switch the APT sources from http:// to https://, which it gives a one-line command for, or set Acquire::Retries to 0 so no download is retried. Some community mirrors do not support HTTPS.

Debian versions and what to do

The fixed versions are apt 3.0.4 for Debian 13 trixie (DSA-6607-1) and apt 2.6.2 for Debian 12 bookworm, now under long-term support. Debian's security tracker still lists the testing and unstable releases, forky and sid, as vulnerable. Debian recommends upgrading apt. The attack needs a man-in-the-middle between the machine and the server it downloads from, so the first to patch should be systems that fetch packages over networks their owners do not control.