Debian APT Flaw CVE-2026-109518 Lets a Man in the Middle Swap Packages and Run Code as Root; Debian Patched, Ubuntu Not Yet

Debian has patched CVE-2026-109518 in APT, the tool that installs software on Debian, Ubuntu and their derivatives. An attacker who sits between a machine and its package mirror can replace a package after APT has verified it, leading to code execution as root, Debian's advisory DSA-6607-1 says. The advisory credits Max Justicz with the discovery.

How the bypass works

APT maintainer Julian Andres Klode rates it a "critical file verification bypass". The attacker combines HTTP redirects with ordinary server errors that make APT retry a download, and that leads APT "to override existing hardlinks with a chosen payload". Signature checks don't stop it: the swap happens once checking is done.

The trick needs retries switched on. Retries have been on by default only since APT 2.3.2, which means from Debian 12 (bookworm) and Ubuntu 22.04 LTS onwards. Ubuntu's description calls older releases "unaffected in a default configuration", unless someone set retries by hand. It counts a malicious mirror or proxy as an on-path attacker and scores the bug 7.7 under CVSS 4.0, priority High.

The same release fixes out-of-bounds memory reads too. For those, Klode expects no impact beyond denial of service for programs such as PackageKit that read untrusted .deb files.

Where Ubuntu stands

On 4 November Ubuntu marked every release from 14.04 to 26.10 as vulnerable in its status table, with no fixed package and no security notice listed.

Fixed versions

• Debian 13 (trixie): apt 3.0.4.
• Debian 12 (bookworm): apt 2.6.2, through Debian LTS advisory DLA-4880-1.
• Debian unstable: apt 3.3.6.
• Other APT branches upstream: 1.2.36, 1.4.12, 1.6.19, 1.8.2.4, 2.0.12, 2.2.5, 2.4.15, 2.8.4 and 3.2.1, for distributions that build their own.