--- id: "CVE-2026-109518" kind: "vulnerability" aliases: ["CVE-2026-109518"] title: "APT on Debian and Ubuntu: network attacker can swap a downloaded package and run code as root; fixed in Debian, Ubuntu fix pending" severity: "high" cvss: 7.7 epss: null exploited: false status: "open" category: "infrastructure" products: [{"name": "apt", "fixed": ["2.6.2"], "affected": "< 2.6.2", "ecosystem": "debian:12"}, {"name": "apt", "fixed": ["3.0.4"], "affected": "< 3.0.4", "ecosystem": "debian:13"}, {"name": "apt", "fixed": ["3.3.6"], "affected": "<= 3.3.5", "ecosystem": "debian:unstable"}, {"name": "apt", "fixed": [], "affected": "all supported releases (14.04 to 26.10) per Ubuntu, no fixed version listed yet", "ecosystem": "ubuntu"}] ecosystems: [] tags: ["apt", "debian", "infrastructure", "linux", "self-hosted", "ubuntu"] not_affected_if: ["default-config-older-release", "no-untrusted-mirror-or-proxy"] published_at: "2026-11-04T16:17:33+00:00" first_seen_at: "2026-11-04T16:28:10+00:00" updated_at: "2026-11-04T16:30:30+00:00" sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109518", "first_seen_at": "2026-11-04T16:28:10+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-04T16:30:30+00:00"}] --- # APT on Debian and Ubuntu: network attacker can swap a downloaded package and run code as root; fixed in Debian, Ubuntu fix pending On Debian, Ubuntu and derivatives, an attacker on the network path or a malicious mirror or proxy can make APT install an unverified attacker-controlled package during a package install. The result is remote code execution with root privileges on the machine running the install. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - debian:12:apt affected < 2.6.2 fixed 2.6.2 - debian:13:apt affected < 3.0.4 fixed 3.0.4 - debian:unstable:apt affected <= 3.3.5 fixed 3.3.6 - ubuntu:apt affected all supported releases (14.04 to 26.10) per Ubuntu, no fixed version listed yet fixed ? ## How to check - Debian: run 'dpkg -l apt' (or 'apt --version'); vulnerable if below 2.6.2 on bookworm, below 3.0.4 on trixie, or 3.3.5 on forky. - Ubuntu: all releases are listed vulnerable for now; check the Ubuntu CVE page for a fixed apt version. - Run 'apt-config dump | grep Acquire::Retries': a non-zero value (default 3 on Debian 12 and Ubuntu 22.04 and later) is required per Ubuntu's description; older releases are unaffected in default config. - Look at /etc/apt/sources.list and /etc/apt/sources.list.d/ for http:// mirrors or proxies you do not control; HTTPS-only trusted mirrors reduce the on-path risk. ## Fix Debian: upgrade apt to 2.6.2 (bookworm, DLA-4880-1), 3.0.4 (trixie, DSA-6607-1) or 3.3.6 (sid); forky still shows 3.3.5 as vulnerable. Ubuntu: Ubuntu's page lists apt as Vulnerable on every release (14.04 to 26.10) with no fixed version yet; watch https://ubuntu.com/security/CVE-2026-109518 and run apt upgrade once it ships. ## Timeline - 2026-11-04T16:28:10+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109518 - 2026-11-04T16:30:30+00:00 analyst — Debian tracker (bookworm 2.6.2, trixie 3.0.4, sid 3.3.6 fixed) and Ubuntu CVE page (all releases vulnerable, no fix yet) read. DSA-6607-1 page itself did not load; DSA text seen only via Phoronix quote. Not exploited, no PoC found. Tier B; no posts saved. ## Documents - [advisory] Debian security tracker: CVE-2026-109518 https://security-tracker.debian.org/tracker/CVE-2026-109518 - [advisory] Ubuntu CVE-2026-109518 https://ubuntu.com/security/CVE-2026-109518 - [describes] Phoronix: Debian APT MITM RCE (quotes DSA-6607-1) https://www.phoronix.com/news/Debian-APT-MITM-RCE - [discussion] @TheHackersNews: ‼️ A new Linux APT flaw in Debian and Ubuntu could let MitM attackers swap alrea https://x.com/TheHackersNews/status/2118022366098006308 - [fix] APT 3.3.6 Released with Security Fix https://linuxiac.com/apt-3-3-6-released-with-security-fix-for-download-verification-bypass/ ## From the sources On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges. The vulnerability is caused by the reuse of hard links and requires the client to follow redirects and retry the download of package files. It requires the client to have a non-zero Acquire::Retries configuration setting; the value 3 is the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older releases are unaffected in a default configuration --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_