APT flaw (CVE-2026-109518) lets MitM swap packages, run as root

A vulnerability in APT, the package manager behind Debian and Ubuntu, lets a man-in-the-middle attacker swap a package after it has passed signature verification and have the substituted code run as root during installation. Tracked as CVE-2026-109518, it was reported by researcher Max Justicz and patched by Debian, Ubuntu and APT's maintainers on November 4, 2026.

The primary references are the Debian security tracker entry and advisory DSA-6607-1, plus the disclosure on the APT developers' list.

What the bug does

APT verifies a package, then — if a download is interrupted and retried — can resume it in a way that lets an attacker who controls the transport substitute a different, malicious package for the verified one. The swapped payload installs and executes as root.

The attack hinges on download retries. An attacker positioned to alter traffic between APT and its mirror — a malicious mirror, proxy, or anyone on the network path for an HTTP source — can force retries using HTTP redirects and temporary server errors, then slip in their package on the retry. Ubuntu scores it 7.7 (CVSS 4.0) and rates it high priority; APT's maintainers describe it as critical. The advisories do not state whether HTTPS mirrors are exposed.

Who is exposed

• Retries are on by default from Debian 12 and Ubuntu 22.04 onward — those releases are affected out of the box.
• Older releases (e.g., Debian 11, Ubuntu 20.04) are not exposed by default, but are if a script or config enabled Acquire::Retries.
• The advisories report no known exploitation in the wild and no public PoC at disclosure.

Fixed versions

Patch to at least:

• Debian trixie: APT 3.0.4 (DSA-6607-1)
• Debian bookworm: APT 2.6.2 (DLA-4880-1)
• Ubuntu 26.10: 3.3.3ubuntu0.1
• Ubuntu 26.04 LTS: 3.2.1ubuntu0.1
• Ubuntu 24.04 LTS: 2.8.4ubuntu0.1
• Ubuntu 22.04 LTS: 2.4.15ubuntu0.1

Action checklist

1. Update APT first, before any other package work. Run sudo apt update && sudo apt install --only-upgrade apt, then confirm with apt --version against the fixed version for your release.
2. Do the first upgrade from a trusted network path — ideally a local, controlled mirror — since the flaw is exploited in transit, and the fix itself arrives over APT.
3. Audit fleet config for Acquire::Retries on older releases; any host that enabled retries is in scope regardless of default.
4. Prefer https mirror URLs as defense-in-depth for the transport, while noting the advisories do not confirm HTTPS fully mitigates — patching is the fix.
5. Rebuild or re-verify anything installed via automated pipelines on affected hosts during the exposure window if you cannot rule out a hostile path.

Context

This is a verification-bypass-by-retry, not a broken signature — APT's cryptography held, and the gap was in how a resumed transfer reconciled with what had already been checked. It rhymes with past APT transport bugs (CVE-2019-3462, where a MitM could inject content via crafted HTTP redirects), and it is a reminder that "the package is signed" protects the artifact, not the delivery state machine around it. Patch window matters here: the fix ships through the very channel the attack abuses, so the clean upgrade is the one you run from a path you trust.