cyber.hendryadrian.com
Vulnerability & Exploit · thehackernews.com

APT Flaw Lets Traffic-Interfering Attackers Replace Verified Packages and Run Code as Root

· Original article ↗

Summary

CVE-2026-109518 lets an attacker who can alter APT download traffic trigger retries and replace a package, potentially running code as root. Debian fixes are available; Ubuntu updates are rolling out. Advisories report no exploitation and do not clarify HTTPS exposure.

Key points

  • CVE-2026-109518 can let an attacker who changes traffic between APT and a package server substitute a checked package and run code as root when it is installed.
  • The attack uses HTTP redirects and temporary server errors to trigger APT download retries.
  • Retries are enabled by default from Debian 12 and Ubuntu 22.04 onward; older Debian 11 and Ubuntu 20.04 releases are not exposed by default, though user scripts may enable retries.
  • Debian has released fixes, including APT 2.2.5 for Debian 11. Ubuntu updates are rolling out, and a fix for Ubuntu 14.04 users with Ubuntu Pro is available.
  • Ubuntu said distributions built on Debian and Ubuntu are also affected but did not name them. At 15:46 UTC on November 4, Ubuntu still marked all eight releases it tracks as vulnerable.
  • The advisories describe no exploitation or workaround for systems that cannot yet update, and do not clarify whether HTTPS package sources are affected.

Article Details

Vulnerability Types
  • APT package verification bypass during download retries
  • Man-in-the-middle package substitution
Severity
Ubuntu rates the flaw high priority (CVSS 4.0 score 7.7); APT's developers call it critical.
Affected Versions
  • Debian 12 and later (retry behavior enabled by default)
  • Debian 11 (exposed if Acquire::Retries is enabled)
  • Debian testing APT 3.3.5
  • Ubuntu 22.04 and later (retry behavior enabled by default)
  • Ubuntu 20.04 (exposed if Acquire::Retries is enabled)
  • Ubuntu 14.04–26.10 (all eight tracked releases were marked vulnerable at 15:46 UTC on November 4)
Exploitation Status
not_reported
Exploit Availability
unknown
Patch Status
partial

MITRE ATT&CK

T1557 · Adversary-in-the-MiddleAn attacker able to modify HTTP traffic between APT and a package server can use redirects and temporary server errors to trigger retries and substitute a package.

CVE

CVE-2026-109518Debian · APT; Ubuntu · APTDebian has released fixed versions of APT for the flaw, CVE-2026-109518. APT's developers, who call the flaw critical, say updates for Ubuntu and its Ubuntu Pro subscription service are being released. Ubuntu 14.04

People

Max JusticzReported the APT flaw.

Vendors

DebianA flaw in APT, the package manager for Debian and Ubuntu, allows an attacker who can modify package downloads to swap a checked package for their own.UbuntuA flaw in APT, the package manager for Debian and Ubuntu, allows an attacker who can modify package downloads to swap a checked package for their own.

Products

APTA flaw in APT, the package manager for Debian and Ubuntu, allows an attacker who can modify package downloads to swap a checked package for their own.Debian LinuxA flaw in APT, the package manager for Debian and Ubuntu, allows an attacker who can modify package downloads to swap a checked package for their own.UbuntuA flaw in APT, the package manager for Debian and Ubuntu, allows an attacker who can modify package downloads to swap a checked package for their own.

Related Articles