APT package retry flaw exposes Debian and Ubuntu systems to root code
Debian, Ubuntu and the developers of APT disclosed a critical package-manager flaw, tracked as CVE-2026-109518, that can allow a man-in-the-middle attacker to substitute a package download and run code as root. The issue affects package installation when an attacker can alter HTTP traffic between APT and a package server, including through a malicious mirror or proxy.
The advisories published on November 4 state that the attack depends on APT retrying a failed download. That behaviour is enabled by default from Debian 12 and Ubuntu 22.04 onward. An attacker can use HTTP redirects and ordinary temporary server errors to induce retries, then replace the package being retrieved.
Why retry behaviour creates the exposure
APT normally verifies packages as part of its download and installation process. The disclosed flaw nevertheless lets an attacker who can tamper with the download path swap a checked package for their own payload. When the system installs that replacement, the attacker-controlled code executes with root privileges.
Ubuntu rates the vulnerability as high priority and assigns it a CVSS 4.0 score of 7.7. It says Debian- and Ubuntu-derived distributions are also affected, although it does not name specific downstream projects. Max Justicz reported the vulnerability.
Systems on Debian 11 and Ubuntu 20.04 are not exposed by default, Ubuntu says, because the retry configuration is not enabled by default there. However, APT developers warn that user scripts may have enabled Acquire::Retries on those releases, making configuration review relevant as well as version checking. The root-level consequences complement risks seen when a container escape to the host enables a container escape to the host, although the APT issue begins in the package-download path.
Fix status across supported releases
Debian has released fixed APT versions for CVE-2026-109518, including version 2.2.5 for Debian 11 after that release reached end of Debian long-term support on August 31. At 14:58 UTC on November 4, Debian's testing branch was still using vulnerable APT version 3.3.5.
Ubuntu published updated APT builds to its security archive at 14:25 UTC for four releases: version 3.3.3ubuntu0.1 for Ubuntu 26.10, 3.2.1ubuntu0.1 for Ubuntu 26.04 LTS, 2.8.4ubuntu0.1 for Ubuntu 24.04 LTS, and 2.4.15ubuntu0.1 for Ubuntu 22.04 LTS. Updates for Ubuntu and Ubuntu Pro were being released, and Ubuntu Pro users on 14.04 could already obtain one.
Neither the Debian, Ubuntu nor APT developer advisories describe observed exploitation or provide a workaround for systems that cannot yet update. They describe the attack over HTTP and do not state whether repositories reached through HTTPS are exposed.
Business implication
Teams should inventory Debian and Ubuntu hosts, confirm the deployed APT version and retry settings, apply the published security updates where available, and examine HTTP repository, mirror and proxy paths as part of package-management risk management.