APT flaw CVE-2026-109518 lets a rogue mirror or proxy swap Debian and Ubuntu packages for root. How to patch safely

A flaw in APT, the tool that installs and updates software on Debian, Ubuntu and the many distributions built on them, lets an attacker who can tamper with package downloads get their own package installed and run as root. Tracked as CVE-2026-109518 and found by researcher Max Justicz, it was disclosed on November 4 by Debian, Canonical and APT's developers, with fixed APT packages released the same day.

Why it matters: APT is supposed to be safe even over untrusted networks, because every package is checked against signed repository metadata before it is installed. This bug breaks that promise. A malicious mirror, a compromised proxy or anyone else sitting on the network path can swap in a package after the check has passed, according to the Debian data published on OSV and The Hacker News. Package installs run as root, so the attacker's code does too.

How the attack works

• What the attacker needs: the ability to change plain HTTP traffic between the machine and its package server. The Hacker News names malicious mirrors and proxies; Cybersecurity News adds rogue Wi-Fi and hijacked routers.
• The trick: the attacker uses HTTP redirects and ordinary temporary server errors to make APT retry a download. Debian's description on OSV says the root cause is reused hard links, which let two downloads end up on the same file. The fix in upstream APT 3.3.6 makes download methods open target files exclusively, Cybersecurity News reports.
• The key condition: APT must be set to retry failed downloads (Acquire::Retries above zero). That is the default (3) on Debian 12 and Ubuntu 22.04 LTS and later, per OSV. Older releases are not exposed out of the box, but APT's developers warn that many scripts turn retries on anyway, The Hacker News says.
• Which tools: the bug sits in APT's HTTP download code, so it affects apt, apt-get, aptitude and Ubuntu's graphical updaters alike, according to GamingOnLinux, which reports that snaps and FTP sources are not affected and that HTTPS sources protect against the attack. (The Hacker News notes the advisories it read describe only the HTTP case.)

Ubuntu rates the flaw high priority with a CVSS 4.0 score of 7.7; APT's own developers call it critical, The Hacker News reports. None of the advisories describe attacks in the wild so far. Justicz also found CVE-2019-3462, an earlier APT redirect bug, Cybersecurity News notes.

Fixed APT versions

Canonical says derivatives of Debian and Ubuntu are also affected, without naming them, per The Hacker News. If you run a distribution built on either, look for an APT update from its maintainers.

What to do

1. Update APT, with retries off while you do it. The update itself travels through APT, so on a network you don't fully trust, switch retries off for that one run. Both GamingOnLinux and Cybersecurity News describe Acquire::Retries=0 as blocking the attack:

sudo apt-get -o Acquire::Retries=0 update
sudo apt-get -o Acquire::Retries=0 install --only-upgrade apt

2. Check the installed package version, and compare it with the table above:

apt-cache policy apt

3. Prefer HTTPS sources. Look in /etc/apt/sources.list and /etc/apt/sources.list.d/ for http:// entries. GamingOnLinux reports that HTTPS protects against this attack, and Cybersecurity News recommends HTTPS mirrors.

4. Can't patch yet? Set retries to zero system-wide as a stopgap, accepting that updates may fail more often on poor connections, as Cybersecurity News notes:

echo 'Acquire::Retries "0";' | sudo tee /etc/apt/apt.conf.d/99-no-retries

Remove the file once the fixed APT is installed.

5. Don't forget containers and build systems. Dockerfiles and CI jobs that run apt-get install on Debian 12+ or Ubuntu 22.04+ base images use the vulnerable defaults. Rebuild on refreshed base images, and treat build hosts on shared or third-party networks as the most exposed.

Who should care most

Anyone updating over networks they don't control (cloud instances behind third-party proxies or mirrors, laptops on public Wi-Fi, CI runners) and anyone using internal HTTP mirrors or caching proxies, since a compromise of that box is exactly the position this bug needs. Users who already fetch packages over HTTPS from official servers are in a much better spot, but should still take the update.