CVE-2026-109518 Lets On-Path Attackers Bypass APT Package Verification
Summary
CVE-2026-109518 lets an on-path attacker potentially replace a verified APT package over manipulable HTTP when retries are enabled, enabling root code execution. Debian and Ubuntu issued fixes; vendor advisories report no real-world exploitation.
Key points
- The flaw involves APT's handling of HTTP redirects, retries, and reused hard links, which can let attacker-controlled content replace a package after verification.
- Exploitation requires the victim to install or upgrade packages, the attacker to manipulate the HTTP network path, and APT retries to be enabled.
- Ubuntu 22.04 and newer enable retries by default; Debian has done so since APT 2.3.2. Older releases may be exposed if retries are configured manually.
- A substituted .deb package can run installation scripts as root. The article says vendor advisories have not reported real-world exploitation.
- Debian and Ubuntu released fixed APT packages. The article lists corrected versions across maintained branches and distributions.
- Install the vendor update; temporarily setting Acquire::Retries=0 or using properly validated HTTPS can mitigate the documented attack path. HTTPS is not a substitute for patching.
Article Details
- Vulnerability Types
- Improper hard-link handling
- Time-of-check/time-of-use race condition
- Package verification bypass
- Severity
- High (CVSS 4.0: 7.7)
- Affected Versions
- APT 1.2.x before 1.2.36
- APT 1.4.x before 1.4.12
- APT 1.6.x before 1.6.19
- APT 1.8.2.x before 1.8.2.4
- APT 2.0.x before 2.0.12
- APT 2.2.x before 2.2.5
- APT 2.4.x before 2.4.15
- APT 2.6.x before 2.6.2
- APT 2.8.x before 2.8.4
- APT 3.0.x before 3.0.4
- APT 3.2.x before 3.2.1
- Ubuntu 26.10 APT before 3.3.3ubuntu0.1
- Ubuntu 26.04 LTS APT before 3.2.1ubuntu0.1
- Ubuntu 24.04 LTS APT before 2.8.4ubuntu0.1
- Ubuntu 22.04 LTS APT before 2.4.15ubuntu0.1
- Ubuntu 20.04 LTS APT before 2.0.12+esm1
- Ubuntu 18.04 LTS APT before 1.6.19+esm1
- Ubuntu 16.04 LTS APT before 1.2.36+esm1
- Ubuntu 14.04 LTS APT before 1.0.1ubuntu2.24+esm4
- Exploitation Status
- not_reported
- Exploit Availability
- none_reported
- Patch Status
- available
- Workarounds
- Temporarily set Acquire::Retries to 0 while applying the security update.
- Use properly validated HTTPS package repositories instead of HTTP where supported.
MITRE ATT&CK
T1195.002 · Compromise Software Supply ChainThe flaw can let an attacker substitute a malicious .deb package in the package-delivery path; its installation scripts can then execute with root privileges.T1557 · Adversary-in-the-MiddleAn on-path attacker can manipulate HTTP traffic between the APT client and package repository to trigger redirects and retries and substitute package content.
CVE
People
Vendors
DebianA high-severity vulnerability in APT, the package management system used by Debian, Ubuntu, and derivative Linux distributions, could allow an on-path attacker to replace a verified software package with a malicious oneUbuntuA high-severity vulnerability in APT, the package management system used by Debian, Ubuntu, and derivative Linux distributions, could allow an on-path attacker to replace a verified software package with a malicious one