The critical CVE-2026-109518 vulnerability in the APT package manager allows an attacker who can intercept HTTP traffic between the client and the repository to replace an already verified package with a malicious one and achieve arbitrary code execution with root privileges. Debian, Ubuntu and derivative distributions are affected. Patches are already available: administrators of systems based on Debian 12 and newer, as well as Ubuntu 22.04 LTS and newer, should update APT immediately, since these versions are vulnerable in the default configuration. Temporary measures include switching to HTTPS package sources or disabling download retries.
Attack mechanism and technical conditions
According to the Ubuntu security advisory, the vulnerability is related to the reuse of hard links in the APT HTTP backend. An attacker positioned between the client and the package server — whether it is a malicious mirror, a compromised proxy, or another way of manipulating HTTP traffic — uses HTTP redirects and temporary server errors to force APT to retry the download. On retry, APT may merge two different downloads after the HTTP redirect assigns them the same URI. Incorrect handling of files when resuming a download makes it possible to replace a package after it has been verified, as described by Debian in DSA-6607-1.
The key condition for exploitation is a non-zero value of the Acquire::Retries parameter. Starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS, the default value is set to 3, which makes these and newer releases vulnerable “out of the box”. Older versions (Debian 11, Ubuntu 20.04 and earlier) are not affected in the default configuration; however, as the APT developers note, many user scripts and guides recommend enabling retries, which expands the attack surface.
The vulnerability affects the HTTP backend of the APT library and all frontends based on it: apt, apt-get, aptitude, as well as Ubuntu graphical package management applications. According to the Ubuntu blog, installing packages via snap is not affected, since snap uses a separate package management system.
Severity assessment
Ubuntu assigns the vulnerability a score of CVSS v4.0 7.7 (High). In their own advisory, the APT developers describe it as a critical file verification bypass. The difference in assessments reflects different methodologies: CVSS takes into account the need for user involvement (starting a package installation) and the requirement for an attacker to be on the traffic path, while the APT developers focus on the fact that a fundamental trust mechanism for packages is being bypassed.
At the time the advisories were published, there were no reports of active exploitation of the vulnerability. The CVE-2026-109518 record in NVD has been registered.
Affected versions and available fixes
According to the Debian security tracker, vulnerable and fixed APT versions for Debian are as follows:
- bookworm: 2.6.1 is vulnerable, fixed in 2.6.2
- trixie: 3.0.3 is vulnerable, fixed in 3.0.4
- forky: fixed in 3.3.6
- sid: fixed in 3.3.7
Ubuntu has published fixes for eight releases. For currently supported versions:
- Ubuntu 26.10: 3.3.3ubuntu0.1
- Ubuntu 26.04 LTS: 3.2.1ubuntu0.1
- Ubuntu 24.04 LTS: 2.8.4ubuntu0.1
- Ubuntu 22.04 LTS: 2.4.15ubuntu0.1
For older releases, fixes are available through Ubuntu Pro and the Extended Security Maintenance (ESM) program:
- Ubuntu 20.04: 2.0.12+esm1
- Ubuntu 18.04: 1.6.19+esm1
- Ubuntu 16.04: 1.2.36+esm1
- Ubuntu 14.04: 1.0.1ubuntu2.24+esm4
Prioritization and practical recommendations
The highest risk is for systems that simultaneously use HTTP package sources and have a non-zero Acquire::Retries value. For Debian 12 and newer, and Ubuntu 22.04 LTS and newer, this is the default configuration. Administrators of older releases should check whether the Acquire::Retries value has been changed manually — in the /etc/apt/apt.conf.d/ files or via automation scripts.
Recommended actions:
- Install the APT update. Before updating, temporarily disable download retries:
apt -o Acquire::Retries=0 update && apt -o Acquire::Retries=0 upgrade apt. - Switch package sources to HTTPS. Using TLS protects against this attack vector, since exploitation requires manipulation of unencrypted HTTP traffic. This is a temporary measure and does not replace installing the patch.
- Check derivative distributions. Ubuntu notes that distributions based on Debian and Ubuntu are also affected. If you use such a distribution, check with its developers for the status of the fix.
We have previously covered vulnerabilities affecting the Ubuntu ecosystem — in particular, a critical RCE in the Linux kernel IPv4 TCP. The current vulnerability in APT is different in that it compromises the update delivery mechanism itself: if the package manager is compromised, the entire trust chain of the system’s software is at risk.
The CVE-2026-109518 vulnerability undermines one of the basic security mechanisms of Linux systems — package verification during installation. Given the scale of Debian and Ubuntu deployment in server infrastructure, container environments and cloud platforms, the top priority is to update APT on all affected systems using the Acquire::Retries=0 parameter during the update itself, and on systems where immediate updating is impossible, to switch package sources to HTTPS.
