Debian and Ubuntu patch APT flaw that lets a network attacker swap verified packages for code that runs as root

APT is the tool that installs and updates software on Debian, Ubuntu and a long list of derivatives. It runs as root. A bug disclosed today, Nov. 4, shows how that trust can be abused.

Debian published advisory DSA-6607-1 for the flaw, tracked as CVE-2026-109518. The advisory credits researcher Max Justicz with finding it. Debian says the result of a successful attack is "the execution of arbitrary code as root."

How the attack works

APT checks each package against signed data before installing it. This bug does not break that check. It gets around it.

According to Debian, APT can merge two separate package downloads after an HTTP redirect gives them the same URI. When APT resumes an interrupted download, it handles the file improperly. That opens a window to substitute a different package after verification has already passed. The substituted package is what gets installed.

The attacker has to sit between the machine and the archive server. That could be someone on the same network, a rogue proxy or a malicious mirror. The attack also depends on hard link reuse, and it needs the client to follow redirects and retry a failed download.

APT's developers said an attacker in that position can force the retries using HTTP redirects and ordinary temporary server errors.

Who is exposed

The bug only works when APT's retry setting, Acquire::Retries, is above zero. That value is 3 by default on Debian 12 (bookworm) and Ubuntu 22.04 LTS. Releases older than those are not affected in their default configuration.

The man-in-the-middle requirement narrows the field compared with an unauthenticated remote hit. It does not shrink the payoff. Anything that reaches the install stage inherits full system privileges. Public Wi-Fi, a hijacked router or a compromised mirror can all supply the network position.

No in-the-wild exploitation has been reported, according to the Ubuntu and Debian notices.

What has been fixed

Debian fixed its stable release, trixie, in APT 3.0.4. The same update closes several unrelated out-of-bounds access bugs. For Debian 11, whose long-term support ended Aug. 31, developers published a fixed build numbered 2.2.5. The Debian Security Tracker points to advisory DLA-4880-1 for bookworm.

Ubuntu's security archive received patched APT builds at 14:25 UTC today:

• Ubuntu 26.10: 3.3.3ubuntu0.1
• Ubuntu 26.04 LTS: 3.2.1ubuntu0.1
• Ubuntu 24.04 LTS: 2.8.4ubuntu0.1
• Ubuntu 22.04 LTS: 2.4.15ubuntu0.1

Ubuntu rates the flaw high priority with a CVSS 4.0 score of 7.7. Ubuntu Pro subscribers on 14.04 can already get a fix, and updates for the rest of the Pro lineup are being released.

Upstream, APT 3.3.6 changes the download methods to open target files exclusively, which stops two downloads from touching the same file. That release also rejects DEB packages missing the required Version field and fixes a sorting bug in the dependency solver.

Debian's testing branch was still carrying the vulnerable APT 3.3.5 as of 14:58 UTC today.

What to do

On trusted networks, run apt update and apt upgrade, then confirm the installed APT version matches the fixed one for your release. Avoid untrusted mirrors and proxies until patched. HTTPS mirrors make interception harder.

As a stopgap on unpatched machines, setting Acquire::Retries to 0 removes one of the required conditions. It can make updates less reliable on poor connections.

Security writer Azeem Hassni flagged the exposure for shared CI runners, builds inside cloud networks and laptops on public Wi-Fi, where a routine upgrade could hand an attacker root.

Not the first time

Justicz found a similar problem in 2019. That bug, CVE-2019-3462, was a remote code execution flaw in apt that also let a man-in-the-middle run code as root through a redirect. The workaround then was to turn off redirects with -o Acquire::http::AllowRedirect=false.

The new flaw is a different bug. Redirect and download handling is again where the failure sits.

One question remains open: Debian has not said when the testing branch will move off 3.3.5 to a fixed version such as upstream's 3.3.6.