CVE-2026-109518: What the APT flaw means for Debian and Ubuntu

On November 4, 2026, Debian and APT maintainers published notices about CVE-2026-109518, a flaw in APT’s handling of package downloads. The described attack requires a nonzero Acquire::Retries setting and an attacker able to manipulate the HTTP download path, such as through a malicious mirror or proxy. Debian’s tracker lists fixed APT versions for four branches; Canonical also announced that Ubuntu fixes were available.

How the APT flaw can replace a package

Redirects and temporary HTTP server errors can cause APT to retry a download. The APT maintainers say the flaw in how APT handles files during that process can let an attacker overwrite existing hard links with chosen data. Debian’s advisory says a package can then be replaced after verification, allowing arbitrary code to run as root when the package is installed. (APT maintainer notice; Debian security advisory)

The attack depends on retries and control of the HTTP path

A nonzero Acquire::Retries value is required for this attack path, but retries alone do not give an attacker access. The attacker also needs to manipulate the HTTP traffic or control a malicious mirror or proxy, with redirects and retry-triggering errors forming part of the described route. (APT maintainer notice)

APT has used retries by default since version 2.3.2. The Debian tracker says the default value is 3 starting with Debian 12 and Ubuntu 22.04 LTS. Scripts or local configuration can also enable retries on older releases, so the default setting does not determine every system’s configuration. (Debian security tracker)

For Debian, match your release branch to the tracker’s fixed APT version; Ubuntu’s fix announcement does not supply a Debian package number.

Debian versions listed as fixed

Debian’s tracker lists these APT versions as fixed for the corresponding branches:

Debian’s November 4 advisory separately identifies APT 3.0.4 as the fix for stable trixie. (Debian security advisory; Debian security tracker)

Canonical announced on November 4 that fixes were available for Ubuntu. (Canonical’s Ubuntu announcement)

The update also left some named issues unfixed

The APT maintainers said the update bundled fixes for several other memory-safety and denial-of-service issues. They also said it did not fix certain out-of-bounds issues in apt-ftparchive and the build-dependency parser, citing implementation complexity, limited practical testing, or regression risk. (APT maintainer notice)