CVE-2026-109518 Lets On-Path Attackers Replace Verified APT Packages and Execute Code as Root

Summary

CVE-2026-109518 lets an on-path attacker exploit APT's HTTP retry handling to replace a package after verification and execute code as root. Debian and Ubuntu fixes are available; advisories reviewed Nov. 5 did not report in-the-wild exploitation.

Key points

The flaw affects APT's HTTP handling of interrupted downloads: an attacker can merge requests, trigger a retry, and overwrite a hard-linked file after its hash is checked.
Exploitation requires control of package traffic, a nonzero Acquire::Retries setting, and an apt install or upgrade; retries are enabled by default on Debian 12+ and Ubuntu 22.04+.
A substituted package can run its maintainer script as root, potentially exposing CI runner secrets, compromising developer machines, or placing malicious code in container images.
Fixed versions include APT 2.6.2 for Debian 12, 3.0.4 for Debian 13, 2.4.15ubuntu0.1 for Ubuntu 22.04, and 2.8.4ubuntu0.1 for Ubuntu 24.04.
Before upgrading vulnerable APT, disable retries for the upgrade command; then update runner images, containers, developer machines, and other affected clients.
The article recommends HTTPS and network/process telemetry as additional safeguards, while noting these do not replace patching APT; the cited advisories did not report exploitation in the wild.

Article Details

Vulnerability Types: Time-of-check to time-of-use (TOCTOU) flaw in APT's HTTP download and resume handling, allowing a package file to be replaced after hash verification
Severity: High (CVSS v4.0 7.7); apt maintainers rate it critical
Affected Versions: apt on Debian 12 and later when Acquire::Retries is non-zero (enabled by default)
apt on Ubuntu 22.04 and later when Acquire::Retries is non-zero (enabled by default)
Older Debian and Ubuntu releases when configuration sets Acquire::Retries above zero
Exploitation Status: not_reported
Exploit Availability: unknown
Patch Status: available
Workarounds: Set Acquire::Retries to 0 before upgrading apt.
Use HTTPS for apt sources; the article says this blocks an on-path attacker, but does not protect against a malicious mirror or a TLS-terminating proxy.