The guarantee behind APT, the package manager under every Debian and Ubuntu system, is that it doesn't matter where a package comes from. Download it from a fast mirror, a corporate caching proxy or a random university server, and APT checks it against signed metadata before installing anything. If the file has been tampered with, APT refuses it.

On Nov. 4, Debian, Ubuntu and the APT developers published advisories for a bug that breaks that guarantee under certain conditions. Tracked as CVE-2026-109518, it lets an attacker who can manipulate HTTP traffic between an APT client and the archive server get the client to install an attacker-controlled, unverified package. Packages install with root privileges, so the result is code execution as root.

Both distributions have shipped fixed versions of apt. If you run Debian 12 or later, or Ubuntu 22.04 or later, update apt soon.

What the bug does

According to the Debian Security Tracker, the attacker has to be "on-path." That means they sit somewhere they can see and change traffic between your machine and the package archive. A malicious mirror or a malicious proxy counts. So does anyone else who can tamper with unencrypted HTTP on the network your servers use.

The tracker puts the root cause in APT's reuse of hard links. A hard link is a filesystem entry that points at the same underlying data as another file. The flaw also requires the client to follow HTTP redirects and retry the download of package files, and it triggers during a package install.

The Hacker News, which reported on the advisories, said the flaw was reported by Max Justicz. It also said the APT developers call the flaw critical. Ubuntu gives it a CVSS 4.0 score of 7.7 and a priority of High on its CVE page.

Why older releases mostly escape

Whether a system is exposed depends on one setting. The attack needs a non-zero value for Acquire::Retries, the APT option that controls how many times a failed download is retried. The Debian tracker says the value 3 is the default starting with Debian 12 "bookworm" and Ubuntu 22.04 LTS, so older releases are unaffected in a default configuration.

"Default configuration" is doing a lot of work there. The Hacker News reports that APT's developers say many user scripts may have turned the retry setting on, even on older releases. Retries are a common fix for flaky mirrors, CI runners and container builds on unreliable networks. An older server whose provisioning scripts or config files set a non-zero retry count loses that default protection. The version ranges in the NVD record reflect this. They list affected APT versions going back years, including versions below 1.2.36, 1.4.0 up to but not including 1.4.12, 1.6.0 up to but not including 1.6.19, and later branches.

What we don't know yet

The Hacker News said none of the three advisory reports describe attacks exploiting the flaw or offer a workaround for systems that cannot update yet. It also said they describe the attack over HTTP and do not say whether package sources reached over HTTPS are exposed. That question matters a lot. Encrypted transport makes on-path tampering much harder, but plenty of Debian and Ubuntu systems still pull from plain HTTP mirrors. Until the developers answer it, don't assume HTTPS sources make you safe. Patch either way.

Fixes did not land everywhere at once. The Hacker News reported that Debian testing was still on the vulnerable 3.3.5 at 14:58 UTC on Nov. 4. At 15:46 UTC, Ubuntu's tracker still marked all eight of its tracked releases as vulnerable. Ubuntu's CVE page now lists fixed apt versions for its supported releases. If you checked early on disclosure day and saw no fix, check again.

What It Means for Defenders

Who is affected: Any Debian or Ubuntu system whose APT client retries downloads, meaning Acquire::Retries is non-zero, and whose package traffic could be tampered with by a mirror, proxy or network attacker. That covers default installs of Debian 12 and 13 and Ubuntu 22.04 and newer. It also covers older systems where someone raised the retry count. Servers, CI build agents, container base images and fleet-managed desktops are all in scope.

Fixed versions, per Debian:

  • Debian 12 "bookworm": apt 2.6.2 via the security archive (DLA-4880-1). Vulnerable before that: 2.6.1.
  • Debian 13 "trixie": apt 3.0.4 via the security archive (DSA-6607-1). Vulnerable before that: 3.0.3.
  • Debian "forky" (testing) and sid (unstable): apt 3.3.6.
  • Debian 11 "bullseye": its LTS support ended Aug. 31, but The Hacker News reports the APT developers have published a fixed version, APT 2.2.5.

Fixed versions, per Ubuntu:

  • Ubuntu 26.10: apt 3.3.3ubuntu0.1
  • Ubuntu 26.04 LTS: apt 3.2.1ubuntu0.1
  • Ubuntu 24.04 LTS: apt 2.8.4ubuntu0.1
  • Ubuntu 22.04 LTS: apt 2.4.15ubuntu0.1
  • Older releases: Ubuntu's CVE page lists fixes for 20.04, 18.04, 16.04 and 14.04 as available with Ubuntu Pro (16.04 and 14.04 via the Legacy Support add-on).

What to do:

  • Update apt first. Install the fixed apt package from your distribution's security updates before your next routine package run, and confirm the installed version matches or exceeds the one listed above. This bug fires during an install, so a vulnerable client pulling a large batch of updates through an untrusted path is exactly the risky case.
  • Rebuild images. Container base images, golden VM templates and CI runners carry whatever apt version they were built with. Rebuild them on patched packages, and update apt early in any build that installs other packages.
  • Audit retry settings on older systems. On releases older than Debian 12 and Ubuntu 22.04, look through APT configuration files, provisioning scripts, Dockerfiles and CI definitions for anything that sets Acquire::Retries above zero. Those hosts are exposed even though their release's default isn't, and they need the fixed apt or a review of that setting.
  • Review your mirrors and proxies. The threat model is a malicious or compromised mirror, or a proxy in the path. Know which mirrors and caching proxies your fleet uses and who runs them. Prefer sources you control or trust until the HTTPS question is settled.
  • Check end-of-life systems. Debian 11 boxes past their support window, and old Ubuntu releases without Pro, are easy to forget. Find them and confirm they are patched.

For CMMC and other compliance shops, this is a routine but high-priority flaw-remediation item. A fix that APT's developers rate critical, to the tool that installs every other fix, is worth recording with a deployment date in your patch records.

Sources