APT Flaw CVE-2026-109518 Lets Attackers Swap Verified Packages and Run Code as Root

Every Debian and Ubuntu system depends on APT, the advanced package tool that fetches, verifies and installs software from remote archives. When an administrator runs apt upgrade, the tool downloads .deb files over the network, checks their cryptographic signatures and then hands them to a privileged installer. Because packages are installed with root privileges, that verification step is the load bearing wall of the whole distribution model. If it can be defeated, the difference between a patched system and a compromised one collapses to a single download.

The design has survived for decades because the trust chain is simple. Archive maintainers sign package indexes, APT checks those signatures, and individual .deb files are pinned to hashes recorded in the signed index. An attacker who controls a mirror is expected to be able to serve corrupt bytes, but not to make APT accept them. That assumption is what security researchers keep testing, and it is the assumption that failed on November 4, 2026.

On that date, the Debian Project, Canonical and the APT developers published coordinated advisories for CVE-2026-109518, a download verification bypass reported by Max Justicz. The flaw lets an on-path attacker, or the operator of a malicious mirror or proxy, replace a package that has already passed verification and have the replacement installed as root. Ubuntu rated it High priority with a CVSS 4.0 score of 7.7, while APT's own maintainer called it a critical file verification bypass.

The attack is not a theoretical signature forgery. It abuses ordinary network behaviour: HTTP redirects and transient server errors cause APT to retry a download, and the retry path handles files in a way that can be tricked. Debian 12 and Ubuntu 22.04 LTS and newer retry by default, which is why the exposure is broad. Older releases such as Debian 11 and Ubuntu 20.04 are not exposed out of the box, but Canonical warns that many user scripts may have enabled the same setting.

Key Facts

APT can merge two different package downloads after an HTTP redirect gives them the same URI, according to Debian Security Advisory DSA-6607-1. Improper file handling when resuming an HTTP download then allows a man-in-the-middle attacker to replace a package after verification, resulting in execution of arbitrary code as root. The advisory was issued on November 4, 2026 by Salvatore Bonaccorso and covers the apt package.

The Hacker News reported on November 4, 2026 that the attack needs APT to retry failed downloads, which it does by default from Debian 12 (bookworm) and Ubuntu 22.04 LTS onward. The Acquire::Retries setting has only been the default since APT 2.3.2, but many user scripts may have been using it on older releases. HTTP redirects and ordinary temporary server errors are enough to make APT retry.

Canonical said in an advisory published on November 4, 2026 that the flaw exists in the HTTP backend invoked by the APT library and affects any APT based frontend, including apt, apt-get, aptitude and graphical applications. Snaps are not affected because they use a different package management system, and fetching over HTTPS protects against the attack because it requires manipulation of HTTP traffic. Ubuntu 22.04 LTS and newer are affected by default, while older releases are exposed only when Acquire::Retries is set to a non-zero value.

Fixed builds arrived quickly. Ubuntu published new APT packages for four releases at 14:25 UTC on November 4: version 3.3.3ubuntu0.1 for Ubuntu 26.10, 3.2.1ubuntu0.1 for Ubuntu 26.04 LTS, 2.8.4ubuntu0.1 for Ubuntu 24.04 LTS and 2.4.15ubuntu0.1 for Ubuntu 22.04 LTS. Canonical's advisory lists fixed versions for all eight supported releases, from 1.0.1ubuntu2.24+esm4 on Trusty 14.04 LTS through 1.2.36+esm1, 1.6.19+esm1 and 2.0.12+esm1 on the older extended support branches. Debian fixed trixie in apt 3.0.4 and bookworm in 2.6.2 through the companion LTS advisory DLA-4880-1.

Upstream, APT 3.3.6 was released on November 4, 2026. Linuxiac reported on November 4, 2026 that the release changes APT's download methods to open target files exclusively, preventing conflicting access during the download process. APT maintainer Julian Andres Klode announced the APT-2026-11-01 security update on the Debian deity mailing list on November 4, 2026, listing fixes for 11 stable branches: 1.2.36, 1.4.12, 1.6.19, 1.8.2.4, 2.0.12, 2.2.5, 2.4.15, 2.6.2, 2.8.4, 3.0.4 and 3.2.1. Debian's security tracker points to fix commit 5af16a8ad0f155233dfb10b7c92ad1903112ef79 on the 3.3.6 branch.

Analysis

The most striking detail is timing. Ubuntu's builds for four releases appeared at 14:25 UTC, yet at 15:46 UTC the same day Canonical still marked all eight releases it tracks, from 14.04 LTS to 26.10, as vulnerable. Debian's testing branch was still on the vulnerable version 3.3.5 at 14:58 UTC on November 4. Fixed packages and a clear public statement of exposure are not the same thing, and the gap between them is where unpatched machines live.

What this really means is that the signature check most administrators treat as a binary guarantee is actually a chain of assumptions about file handling, and one weak link is enough. The flaw does not break OpenPGP. It tricks APT into installing a package even when signature verification fails, and a malicious mirror can deliver unsigned packages through the same path. The cryptographic layer held. The plumbing around it did not.

Severity scoring captures only part of the risk. A CVSS 4.0 score of 7.7 is High, not Critical, and APT's developers used the word critical anyway. The difference is context. A score of 7.7 usually implies some precondition, and here the precondition is being on the network path or trusting the wrong mirror, which for a laptop on public wireless networks or a server behind a compromised proxy is not much of a barrier. Root code execution with no user interaction beyond a routine upgrade is a severe outcome.

The response also shows how mature the ecosystem's machinery is. Within hours, Debian stable, Debian LTS, Ubuntu and Ubuntu Pro channels had builds, and upstream shipped 3.3.6 with a structural fix rather than a configuration band aid. Canonical's recommended interim mitigation, running apt upgrade with -o Acquire::Retries=0, closes the attack path but leaves users without retry resilience, so it is a bridge and not a destination. Debian chose to recommend upgrading rather than publish a workaround.

Why It Matters

The blast radius extends past two vendors. Canonical noted that distributions built on Debian and Ubuntu are affected as well, without naming any, and the same codebase ships across Debian stable and LTS, Ubuntu and Ubuntu Pro, and downstream derivatives. APT is not a niche utility. It is the component that decides what software exists on a very large share of the world's Linux servers, on containers built from Debian base images, and on developer workstations.

None of the three advisories describe attacks exploiting the flaw in the wild, and that absence matters. It means the window for defenders is still open, but it also means there is no evidence to calibrate how aggressively the bug was probed. Max Justicz reported it responsibly, and the coordinated disclosure on November 4, 2026 gave administrators a single date to plan around. Unattended upgrades, enabled by default since Ubuntu 16.04, apply the patch within 24 hours on systems that have them turned on.

The deeper lesson concerns mirrors. Most organisations do not run their own archive server. They inherit one from a cloud provider, a university or a regional network. The threat model for APT has always included a hostile mirror, and this flaw made that threat real rather than theoretical. Switching archive URLs to HTTPS is the single highest value configuration change available, because the attack requires manipulation of HTTP traffic.

Next Up

Administrators should confirm which APT version is installed rather than assume an unattended upgrade landed. Debian 13 trixie needs 3.0.4 or later, Debian 12 bookworm needs 2.6.2, and the Ubuntu versions to check are 3.3.3ubuntu0.1 on 26.10, 3.2.1ubuntu0.1 on 26.04 LTS, 2.8.4ubuntu0.1 on 24.04 LTS and 2.4.15ubuntu0.1 on 22.04 LTS, with extended support builds covering 14.04 through 20.04. Systems that cannot patch immediately should run upgrades with Acquire::Retries set to zero.

Expect derivative distributions to publish their own advisories in the days after November 4, 2026, and expect scrutiny of the retry code path that made the bypass possible. The same APT-2026-11-01 update also bundles fixes for out-of-bounds memory accesses that could cause denial of service in third-party applications parsing .deb files at a privilege boundary, including PackageKit, aptdaemon and qapt, plus an unbound memory exhaustion bug tracked as Debian bugs 1111554 and 1152704. The next patch cycle is already queued.