A newly patched vulnerability in APT, the package manager underlying Debian, Ubuntu, and their derivatives, could have let an on-path attacker substitute a malicious package after verification and run arbitrary code as root. Debian and Ubuntu have both shipped fixes for the flaw, tracked as CVE-2026-109518, following its disclosure on November 4.
How the flaw worked
The issue stemmed from how APT handles HTTP redirects and resumed downloads. According to Debian's advisory, "APT can merge two different package downloads after an HTTP redirect gives them the same URI," and improper handling of resumed downloads allowed a man-in-the-middle attacker to replace a package after it had already passed verification. APT developers explained that an attacker could exploit redirects and transient HTTP server errors-conditions that trigger APT's retry logic-to cause the tool to overwrite existing hard links with attacker-chosen content. Because Debian-based systems install packages with root privileges, a successful substitution could hand an attacker full control of the machine.
The bug required APT's Acquire::Retries setting to be non-zero, which has been the default since APT version 2.3.2. Ubuntu confirmed the default retry value of three applies from Debian 12 (Bookworm) and Ubuntu 22.04 LTS onward, meaning most current installations were exposed unless retries had been manually disabled. Older releases without retries enabled by default were not affected unless an administrator or script had turned the feature on.
Discovery and severity
Security researcher Max Justicz is credited with finding the flaw. In a post on X, Justicz said, "I used an AI for two hours and found a zero-day that would let a nation-state hack any server running stock Ubuntu." Ubuntu rated the vulnerability High, with a CVSS score of 7.7. Exploitation required an attacker capable of manipulating HTTP traffic between an APT client and an archive server-a position a malicious mirror or proxy could provide, though the attack also depended on specific download conditions being met, such as a redirect or retry being triggered at the right moment.
Fixes and recommended action
Debian patched the issue in APT 3.0.4 for Debian 13 (Trixie) and in version 2.6.2 for Debian 12 (Bookworm). Ubuntu released corrected packages for 22.04 LTS, 24.04 LTS, and 26.04 LTS, and also published a fix for 26.10 alongside its November 4 advisory. The underlying correction, authored by APT developer Julian Andres Klode on October 12, changes how the download code opens destination files: it now opens files exclusively and unlinks any existing file before writing partially downloaded content, preventing writes from being redirected through pre-existing hard links.
Ubuntu advises administrators to update APT immediately, temporarily disable retries while remediating affected systems, and use HTTPS for package downloads, which blocks the traffic manipulation this attack scenario depends on. For enterprise teams, the practical priority is auditing which systems have retries enabled, confirming patched APT versions have reached production machines, and verifying that base images used for provisioning new servers or containers include the fix before further deployment.