Debian and Ubuntu Patched an APT Flaw That Lets MitM Attackers Swap Packages and Run as Root

APT is the tool millions of Debian and Ubuntu machines trust to install only verified software. It turns out that, with a redirect and a retry, it could be talked into installing an attacker's package instead, and running it as root.

Debian and Ubuntu shipped fixes on 4 November for CVE-2026-109518, a flaw found by security researcher Max Justicz. APT's own developers call it critical. Ubuntu rates it High, with a CVSS 4.0 score of 7.7.

Swapped after the check

The attacker needs a spot on the network path between a machine and its package archive. A malicious mirror or proxy qualifies. From there, they can tamper with the HTTP traffic.

Debian's advisory describes the core problem. APT "can merge two different package downloads after an HTTP redirect gives them the same URI," and improper file handling when it resumes a download "allows a man-in-the-middle attacker to replace a package after verification, resulting in the execution of arbitrary code as root."

The root cause is the reuse of hard links. The attacker uses redirects and ordinary temporary server errors to make APT retry a download, and those retries turn hard links into an attack surface. The payload fires when the machine installs the package.

A safety feature became the way in

The attack only works when APT is set to retry downloads, through a non-zero Acquire::Retries value. Retries became the default in APT 2.3.2, so Debian 12 bookworm and Ubuntu 22.04 LTS onward ship with a value of 3. The feature was meant to help machines ride out flaky mirrors.

Older releases are safe in a default setup. Plenty of admin scripts turn retries on anyway.

The fix comes from APT developer Julian Andres Klode, in a commit authored on 12 October. APT now opens destination files exclusively and unlinks existing files before copying partial downloads, so a download can no longer write through an existing hard link.

The patch race

Fixed builds are APT 3.0.4 for Debian 13 trixie and 2.6.2 for bookworm, covered by DSA-6607-1 and a bookworm advisory. Unstable gets 3.3.6. Debian 11, whose LTS ended on 31 August, still got a 2.2.5 build from the APT developers. On Ubuntu, the fixed versions are 3.3.3ubuntu0.1 for 26.10, 3.2.1ubuntu0.1 for 26.04 LTS, 2.8.4ubuntu0.1 for 24.04 LTS and 2.4.15ubuntu0.1 for 22.04 LTS, with Ubuntu Pro covering releases back to 14.04.

The rollout was not perfectly smooth. Ubuntu pushed new builds to its security archive at 14:25 UTC, yet its tracker still marked all eight releases vulnerable at 15:46 UTC. Debian testing was still on the vulnerable 3.3.5 at 14:58 UTC. Distributions built on Debian and Ubuntu are affected too.

Machines that cannot update yet can set Acquire::Retries to 0 for the update and the APT upgrade itself. Ubuntu also recommends HTTPS for package downloads, though the advisories describe the attack over HTTP and do not clearly say whether HTTPS sources are exposed.

It lands days after another root-class Linux scramble, a remote root kernel TCP bug where Debian shipped a fix while Ubuntu LTS users were still waiting. Here, both distributions moved on the same day. None of the three advisories reports exploitation in the wild.

Some offers on this page may be paid placements or contain affiliate links.