On November 4, Debian (DSA-6607-1) and Ubuntu (USN-8996-1) fixed a flaw in the APT package manager itself, CVE-2026-109518, discovered by Max Justicz. Debian's advisory explains that APT can merge two different package downloads after an HTTP redirect gives them the same URI, and that improper file handling when resuming an HTTP download allows a man-in-the-middle attacker to replace a package after verification, resulting in arbitrary code execution as root. Ubuntu scores it CVSS v4 7.7.

Who Is Affected

  • The attacker must be able to tamper with HTTP traffic between APT and the archive, and NVD's description explicitly includes a malicious mirror or proxy. Debian's and Ubuntu's official archives use HTTP by default and rely on signatures and hashes to stop tampering; this flaw defeats exactly the step after verification.
  • Exploitation needs APT to follow redirects and retry downloads, meaning Acquire::Retries is not 0. That value has defaulted to 3 since Debian 12 and Ubuntu 22.04, so default setups on those releases and later are affected; older releases are unaffected by default, but if your scripts set retries themselves, you need the fix too.
  • The same Debian update also fixes several out-of-bounds access issues.

Fixed Versions and How to Update

  • Ubuntu: apt 2.4.15ubuntu0.1 on 22.04, 2.8.4ubuntu0.1 on 24.04, 3.2.1ubuntu0.1 on 26.04 and 3.3.3ubuntu0.1 on 26.10; 20.04 and older get it through Ubuntu Pro's ESM.
  • Debian: 3.0.4 on 13 (trixie) and 2.6.2 on 12 (bookworm, DLA-4880-1).
  • Check the installed version with apt-cache policy apt. Updating apt is itself done by the old apt; the researcher who forwarded the advisory to the oss-security mailing list noted that setting Acquire::Retries to 0 may mitigate the issue until you upgrade, so the careful route is sudo apt -o Acquire::Retries=0 update followed by sudo apt -o Acquire::Retries=0 install --only-upgrade apt.

Two Things Worth Doing While You're There

First, check your sources for unfamiliar third-party mirrors or proxies, and use HTTPS sources where you can. Second, this kind of "install a package, get poisoned" supply-chain risk isn't unique to APT; September's ChainDrop worm on npm was another form of it, covered in this report. For choosing a distribution and knowing which releases are still supported, see choosing a VPS operating system and the Ubuntu 22.04 support timeline; if you worry that someone has already tampered with the server, work through compromise investigation.