Debian and Ubuntu disclosed an APT vulnerability on November 4, 2026, that can let an attacker replace a verified software package and execute code as root. Their advisories identify CVE-2026-109518 as a threat to package installation on affected Linux systems when an attacker can manipulate HTTP downloads. Security updates are available.

Debian credits researcher Max Justicz with discovering the flaw. APT developers classify it as a critical file-verification bypass, while Ubuntu assigns a high priority and a CVSS 4.0 score of 7.7. The issue affects the package manager used to retrieve and install software, placing the installation process itself at risk.

According to Debian, an HTTP redirect can cause APT to merge two package downloads under the same URI. Incorrect handling of a resumed download then allows a package to be replaced after verification. APT developers explain that redirects and temporary HTTP server errors trigger retries that overwrite existing hard links with an attacker-selected payload.

Ubuntu says exploitation requires an on-path attacker, such as a malicious mirror or proxy, able to alter HTTP traffic between the client and archive server. The Acquire::Retries setting must be nonzero; it defaults to three from Debian 12 and Ubuntu 22.04 onward. Older releases are not exposed in their default configuration, although APT developers warn that user scripts may enable retries.

Debian advisory DSA-6607-1 identifies APT 3.0.4 as the fix for Debian 13, known as trixie. Ubuntu lists fixes in 2.4.15ubuntu0.1 for 22.04 LTS, 2.8.4ubuntu0.1 for 24.04 LTS, 3.2.1ubuntu0.1 for 26.04 LTS and 3.3.3ubuntu0.1 for 26.10. Its tracker also lists fixes for older releases through Ubuntu Pro, with Legacy Support required for some versions.

The reviewed Debian, Ubuntu and APT advisories do not report exploitation in the wild or identify compromised organizations. Debian recommends upgrading APT packages. Administrators can use the distribution advisories to identify the corrected build for their release; the differing default retry settings mean exposure also depends on local configuration.