APT, the package manager on Debian, Ubuntu and their derivatives, has a flaw (CVE-2026-109518) that lets an attacker swap a downloaded package for their own after APT has already checked it. Debian’s advisory explains the mechanism: after an HTTP redirect, APT can merge two different package downloads that end up with the same file location, and the way it handles resuming a download lets a man-in-the-middle replace the package after verification. Because packages install with root privileges, the attacker’s code then runs as root. APT’s developers call the flaw critical; Ubuntu rates it high priority with a CVSS 4.0 score of 7.7.
The attacker has to be able to change the HTTP traffic between the machine and its package server. Ubuntu names a malicious mirror or proxy as examples. Per APT’s developers, the attack uses HTTP redirects and ordinary temporary server errors to make APT retry a download, so it only works when APT’s Acquire::Retries setting is above zero. That setting defaults to 3 starting with Debian 12 and Ubuntu 22.04 LTS. Max Justicz reported the flaw. The Hacker News reports that none of the three advisories (Debian, Ubuntu and APT’s own) describe attacks exploiting it or offer a workaround for systems that cannot update, and they do not say whether package sources reached over HTTPS are exposed.
How to check if you’re affected
Affected products are APT on Debian, Ubuntu, and distributions built on them (Ubuntu says derivatives are affected but names none). Run apt --version and compare it with the fixed versions below, then update with your normal package-update routine.
- Debian 12 (bookworm): fixed in apt 2.6.2 (security repository).
- Debian 13 (trixie): fixed in apt 3.0.4 (DSA-6607-1).
- Debian unstable (sid): fixed in 3.3.6; Debian’s tracker listed the testing branch (forky) at 3.3.5, still vulnerable, when it was read.
- Debian 11: Debian long-term support ended on August 31; APT’s developers published a fixed version, 2.2.5, per The Hacker News.
- Ubuntu 26.10: 3.3.3ubuntu0.1. Ubuntu 26.04 LTS: 3.2.1ubuntu0.1. Ubuntu 24.04 LTS: 2.8.4ubuntu0.1. Ubuntu 22.04 LTS: 2.4.15ubuntu0.1.
- Ubuntu 20.04, 18.04, 16.04 and 14.04: fixes (2.0.12+esm1, 1.6.19+esm1, 1.2.36+esm1, 1.0.1ubuntu2.24+esm4) are available through Ubuntu Pro; 16.04 and 14.04 also need the Legacy Support add-on.
Ubuntu says releases older than 22.04 and Debian 11 are not exposed in a default configuration, but APT’s developers warn that many user scripts turn on Acquire::Retries anyway, so do not skip the update on older systems. If you cannot update yet, none of the sources offer a workaround. Pointing APT only at package sources you trust and reach over a network you control is ordinary caution, not guidance from the advisories.