---
title: APT flaw CVE-2026-109518 lets a malicious mirror, proxy or on-path attacker swap a verified package and get root on Debian 12+ and Ubuntu 22.04+; Debian and Ubuntu fixes out | ctxsec
url: https://ctxsec.com/items/debian-ubuntu-apt-cve-2026-109518-redirect-retry-package-swap-root
description: "Debian's APT maintainers say a remote attacker who can tamper with HTTP traffic between APT and an archive (including a malicious mirror or proxy) can use redirects plus transient server errors that make APT retry, causing APT to overwrite hard-linked files with a chosen payload after verification. Packages install as root, so this can mean remote code execution. It depends on Acquire::Retries being non-zero, which has been the default since APT 2.3.2 (Debian 12 and Ubuntu 22.04 onward). Debian fixed it in apt 2.6.2 (bookworm) and 3.0.4 (trixie). Ubuntu rates it High and shipped fixes in USN-8996-1 (Nov 4): apt 2.4.15ubuntu0.1 (22.04), 2.8.4ubuntu0.1 (24.04), 3.2.1ubuntu0.1 (26.04), 3.3.3ubuntu0.1 (26.10), with ESM builds for 14.04 to 20.04 through Ubuntu Pro. Reported by Max Justicz."
status: "official (Debian DSA-6607-1 / DLA-4880-1, APT-2026-11-01; Ubuntu USN-8996-1, Nov 4), last updated Nov 4, 2026, 3:55 PM ET"
published: 2026-11-04
updated: 2026-11-04T15:55:00-05:00
---

> Debian's APT maintainers say a remote attacker who can tamper with HTTP traffic between APT and an archive (including a malicious mirror or proxy) can use redirects plus transient server errors that make APT retry, causing APT to overwrite hard-linked files with a chosen payload after verification. Packages install as root, so this can mean remote code execution. It depends on Acquire::Retries being non-zero, which has been the default since APT 2.3.2 (Debian 12 and Ubuntu 22.04 onward). Debian fixed it in apt 2.6.2 (bookworm) and 3.0.4 (trixie). Ubuntu rates it High and shipped fixes in USN-8996-1 (Nov 4): apt 2.4.15ubuntu0.1 (22.04), 2.8.4ubuntu0.1 (24.04), 3.2.1ubuntu0.1 (26.04), 3.3.3ubuntu0.1 (26.10), with ESM builds for 14.04 to 20.04 through Ubuntu Pro. Reported by Max Justicz.

[← Cybersecurity News](/news) · [markdown](/items/debian-ubuntu-apt-cve-2026-109518-redirect-retry-package-swap-root.md)

official (Debian DSA-6607-1 / DLA-4880-1, APT-2026-11-01; Ubuntu USN-8996-1, Nov 4)

2026-11-04 · updated

Nov 4, 2026, 3:55 PM ET

### APT flaw CVE-2026-109518 lets a malicious mirror, proxy or on-path attacker swap a verified package and get root on Debian 12+ and Ubuntu 22.04+; Debian and Ubuntu fixes out

- **Debian:** `apt update && apt install apt` from the security archive, then confirm the version is 2.6.2 (bookworm), 3.0.4 (trixie) or 3.3.6 (sid).
- **Ubuntu:** install [USN-8996-1](https://ubuntu.com/security/notices/USN-8996-1) (`sudo apt update && sudo apt install --only-upgrade apt`) and confirm 2.4.15ubuntu0.1 (22.04), 2.8.4ubuntu0.1 (24.04), 3.2.1ubuntu0.1 (26.04) or 3.3.3ubuntu0.1 (26.10). Older LTS releases get fixes through Ubuntu Pro ESM.
- **Until patched:** the attack needs an on-path position and APT's retry behavior. Prefer HTTPS mirrors you trust and avoid untrusted proxies. Debian notes older releases are also affected if scripts set `Acquire::Retries` themselves.
- The same update bundles fixes for several out-of-bounds reads that Debian says are denial-of-service only (e.g. against PackageKit-style root daemons parsing local .deb files).

Sources: [Debian deity list: APT-2026-11-01 security update (Julian Andres Klode, Nov 4)](https://lists.debian.org/deity/2026/11/msg00005.html) · [Debian security tracker: CVE-2026-109518](https://security-tracker.debian.org/tracker/CVE-2026-109518) · [Ubuntu: CVE-2026-109518](https://ubuntu.com/security/CVE-2026-109518) · [Ubuntu USN-8996-1: APT vulnerability (Nov 4)](https://ubuntu.com/security/notices/USN-8996-1)