APT: package-swap flaw on redirects and retries (CVE-2026-109518) fixed in Ubuntu and Debian updates
Published 11/11/2026 21:55
Timeline
2 events over 7 d
- 04/11/2026 14:37ConfirmedUbuntu Security Notices+7 d
- 11/11/2026 21:55Published on WatchtowerPro CISO
In short
APT, the package manager on Debian, Ubuntu and derivatives, has a flaw in its HTTP backend. When a download is redirected and retried, APT can merge two different package downloads that end up with the same URI, and it mishandles hard links and file resuming.
How bad is it
High. An attacker who can tamper with the network traffic or runs a malicious mirror can get their own package installed on a Debian or Ubuntu system and run code as administrator, when the system installs packages over plain HTTP with download retries on.
Confirmed by the vendor or a CERT - no exploitation reported yet.
Severity score
CVSS 4.0 from NVD, from ubuntu.com, read 11/11/2026.
What an attacker needs
- Internet access to itEnough
- A loginNot needed
- A user to clickYes
- Special settingsUsually yes
Red helps the attacker, blue holds them back, grey is not published yet.
If it works, an attacker can
- Run their own code on the system
- Read the data it holds
- Change or delete that data
- Take it offline
Type: remote code execution.
A score is the worst case for the flaw, not a verdict on any one system. How we score · ReconX customers see which of their own systems are affected.
Affected versions
- The APT HTTP backend. Every APT front end is affected: apt, apt-get, aptitude and the Ubuntu graphical applications.
- Ubuntu: versions before 1.0.1ubuntu2.24+esm4, 1.2.36+esm1, 1.6.19+esm1, 2.0.12+esm1, 2.4.15ubuntu0.1, 2.8.4ubuntu0.1, 3.2.1ubuntu0.1 and 3.3.3ubuntu0.1, each within its own branch.
- Debian: bookworm 2.6.1 and trixie 3.0.3 are marked vulnerable.
- The flaw needs the client to follow redirects and retry package downloads. Acquire::Retries above 0 is required; the default is 3 from Debian 12 and Ubuntu 22.04 LTS, so those releases are affected out of the box.
- Plain HTTP archive sources are exposed; HTTPS sources protect against this unless TLS verification is disabled. Exploitation only works if the target installs a .deb package.
- Not affected: Snap packages and other transports such as FTP.
What to do now
- Update apt to the fixed version for your release: Ubuntu 26.10 3.3.3ubuntu0.1, 26.04 LTS 3.2.1ubuntu0.1, 24.04 LTS 2.8.4ubuntu0.1, 22.04 LTS 2.4.15ubuntu0.1; Ubuntu ESM 20.04 2.0.12+esm1, 18.04 1.6.19+esm1, 16.04 1.2.36+esm1, 14.04 1.0.1ubuntu2.24+esm4; Debian 12 2.6.2, Debian 13 3.0.4; upstream 3.3.6.
- Install the update with retries off, because the update path itself uses the vulnerable code. Full upgrade: sudo apt update && sudo apt upgrade -o Acquire::Retries=0. Apt only: sudo apt update && sudo apt install -o Acquire::Retries=0 --only-upgrade '?source-package(^apt$)'.
- Interim measure: switch APT sources from http:// to https:// in /etc/apt/sources.list and /etc/apt/sources.list.d/. Interim measures reduce exposure and do not make a server safe; only the update does.
- Ubuntu 20.04 and older receive the fix only through ESM, which needs Ubuntu Pro.
- Rebuild container images and CI runners that run apt-get after the base images are fixed.
ReconX customers see the full notice - and their own systems
Our customers are alerted at every phase. Until a patch exists, the ReconX agent watches their servers from the inside for anomalies, and our outside view - the attacker's view - shows which systems to fix first.
In ReconX: the full analysis, 5 open questions, followed up as sources answer and all 7 sources with their dates. And technology matching: which of your systems run APT, at which version, fixed or not - and what each one needs.
Main sources
USN-8996-1: APT vulnerability Vendor · [NEU] [hoch] apt: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit Administratorrechten CERT · CVE-2026-109518: RCE in apt(1) (DSA 6607-1) Research