A significant flaw has been identified in APT, the package management tool used by Debian and Ubuntu systems. This vulnerability allows attackers to substitute legitimate package downloads with compromised versions, executing their code with root privileges. The flaw, detailed in advisories from Debian, Ubuntu, and APT developers, was disclosed on November 4, 2026.
The Nature of the Vulnerability
The vulnerability, cataloged as CVE-2026-109518, is marked as critical. It enables attackers to perform man-in-the-middle attacks by altering package downloads. This is facilitated by APT’s default behavior of retrying failed downloads, a feature active in Debian 12 and Ubuntu 22.04 onwards. This retry mechanism can be exploited to execute malicious code with elevated system permissions.
For Debian 11, which no longer receives long-term support as of August 31, fixed APT version 2.2.5 has been made available. Although older versions like Debian 11 and Ubuntu 20.04 are not vulnerable by default, developers warn that user scripts might have activated the retry setting, making them susceptible.
Response from Debian and Ubuntu
In response to this critical security issue, Debian has released updated APT versions to patch the flaw. Similarly, Ubuntu has issued new APT builds to its security archive for four different releases, including Ubuntu 26.10 and several LTS versions. Ubuntu rates this flaw as high priority, with a CVSS 4.0 score of 7.7, highlighting the potential risk to systems built upon Debian and Ubuntu.
As of 15:46 UTC on November 4, all eight Ubuntu releases from 14.04 LTS to 26.10 were still considered vulnerable. The vulnerability stems from the potential for an attacker, such as a malicious proxy or mirror, to intercept and modify HTTP traffic between APT and the package server during the installation process.
Implications and Next Steps
This critical flaw underscores the importance of securing package management systems, particularly those that still use HTTP for package sources. The advisories issued do not mention any known exploits currently in the wild, nor do they provide workarounds for systems unable to update immediately. The vulnerability primarily affects systems using HTTP, and it remains unclear if systems relying on HTTPS are similarly exposed.
Reported by security researcher Max Justicz, this vulnerability calls for immediate action to secure affected systems. Users are urged to apply the updates provided by Debian and Ubuntu promptly to mitigate potential risks. Continuous monitoring and adopting secure configurations are essential in safeguarding against future vulnerabilities.
