Ubuntu and Debian have patched a vulnerability in APT that can allow an attacker controlling package-download traffic to install malicious software with root privileges. The flaw, CVE-2026-109518, affects the package manager’s handling of HTTP downloads, rather than the Linux kernel.
Researcher Max Justicz told TechCrunch he used GPT-5.6 Sol through Daybreak Blue and found the issue in two hours.
The security findings are independently documented in Ubuntu’s November 4 security notice and Debian’s advisory, both of which credit Justicz. Canonical rates the vulnerability High, with a CVSS 4.0 score of 7.7.
How a verified download can become an untrusted package
Debian explains that an HTTP redirect can cause APT to merge two package downloads sharing a URI. Incorrect file handling during a resumed download then allows an attacker to replace a package after verification. Because installation runs with root privileges, this can lead to full system compromise.
The APT maintainer’s technical announcement identifies the combination of redirects, transient HTTP errors, retries and reused hard links. Exploitation requires download retries to be enabled. That has been APT’s default since version 2.3.2, although administrators and scripts may also enable it on older installations.
Canonical says Ubuntu 22.04 LTS and later are affected by default. Earlier Ubuntu releases require a non-zero Acquire::Retries setting. An attacker needs influence over the HTTP traffic, such as an on-path position or a malicious mirror or proxy; knowing a server’s address alone does not provide that capability.
Install the distribution’s APT update
The Ubuntu CVE tracker lists these fixed APT packages:
- Ubuntu 26.10:
3.3.3ubuntu0.1 - Ubuntu 26.04 LTS:
3.2.1ubuntu0.1 - Ubuntu 24.04 LTS:
2.8.4ubuntu0.1 - Ubuntu 22.04 LTS:
2.4.15ubuntu0.1
Updates for older Ubuntu releases are available through the applicable Ubuntu Pro channels. Debian’s stable trixie release is fixed in APT 3.0.4.
Canonical says HTTPS protects traffic against this attack and that setting Acquire::Retries to 0 prevents the required retry behavior. Its guidance covers APT-based frontends, including graphical applications; snap installations use a separate system. Installing the fixed APT package remains the remediation.
The CVE record’s CISA enrichment records no exploitation in its November 4 assessment. That is a dated assessment, rather than a guarantee that every exposed system remains untouched.
