Top Highlights
- CVE-2026-109518 can let an attacker replace an APT package and execute code as root.
- Attackers can manipulate HTTP traffic, using redirects and temporary server errors to trigger download retries.
- Retries are enabled by default on Debian 12+ and Ubuntu 22.04+; older releases may be exposed if
Acquire::Retriesis enabled.
Threat, Attack Techniques, and Targets
The APT flaw, CVE 2026 109518, affects Debian and Ubuntu package installations. An attacker who can alter HTTP traffic between APT and a package server can use redirects and temporary server errors to trigger download retries. The attacker can then replace a verified package with malicious code that runs as root.
The attack requires APT to retry failed downloads. Retries run by default in Debian 12 and later and Ubuntu 22.04 and later. However, scripts may enable retries on older releases. Debian and Ubuntu based distributions may also face risk, though the advisories do not name them.
Impact, Security Implications, and Remediation
Because the attacker can run code as root, a successful attack can give them full control of the affected system. Debian rates the APT flaw as critical. Ubuntu rates it high priority, with a CVSS 4.0 score of 7.7. The advisories do not report known exploitation or describe whether HTTPS package sources face exposure.
Therefore, install the applicable APT security update from the relevant vendor. Debian has released fixes, including version 2.2.5 for Debian 11. Ubuntu published updated APT builds for Ubuntu 22.04, 24.04, 26.04, and 26.10. Check vendor advisories for current package status, especially for other releases and Debian based distributions. The advisories provide no workaround, so obtain further guidance from the relevant vendor or authority if you cannot update.
Expand Your Tech Knowledge
Learn how the Internet of Things (IoT) is transforming everyday life.
Discover archived knowledge and digital history on the Internet Archive.
ThreatIntel-V1
