Critical APT Flaw in Debian and Ubuntu: What to Do

On 4 November 2026, Debian, Ubuntu and the APT developers released fixes for CVE-2026-109518, a flaw in the package manager those systems use. Anyone who controls the HTTP traffic to the package archive can slip in a fake package and run code as root. Debian 12, Ubuntu 22.04 and later are exposed by default.

What we know

  • What it is: per the Debian security tracker and Ubuntu's CVE page, an on-path attacker (for example a malicious mirror or proxy) who can manipulate HTTP traffic while a package is being installed can make APT install an unverified one. Packages install with root privileges, so that means control of the server.
  • What makes it possible: APT retrying failed downloads, a setting called `Acquire::Retries`. The APT developers say it has been on by default since APT 2.3.2; Debian and Ubuntu specify that the value 3 ships by default from Debian 12 (bookworm) and Ubuntu 22.04 LTS. Older releases aren't exposed in their default configuration, although the developers warn that many scripts turned the setting on anyway.
  • Severity: the APT developers call it «critical»; Ubuntu rates it High, 7.7 out of 10 on CVSS 4.0.
  • Who found it: every advisory credits Max Justicz.
  • Is it exploited: none of the advisories mention known exploitation.
  • What's not affected: according to Ubuntu, snap packages use a different system and aren't affected, and HTTPS package sources protect against this attack.
  • Fixed versions (4-Nov advisories):

- Debian 13 (trixie): 3.0.4 (DSA-6607-1).

- Debian 12 (bookworm): 2.6.2 (DLA-4880-1, per the Debian tracker).

- Ubuntu 26.10: 3.3.3ubuntu0.1 · 26.04 LTS: 3.2.1ubuntu0.1 · 24.04 LTS: 2.8.4ubuntu0.1 · 22.04 LTS: 2.4.15ubuntu0.1.

- Ubuntu 20.04 LTS and older: fixed only for Ubuntu Pro subscribers.

- Debian testing (forky) was still on vulnerable 3.3.5 when the tracker was checked.

What changes and what doesn't

  • It changes things for any Debian or Ubuntu server where packages get installed or updated: until APT is fixed, every `apt install` or `apt upgrade` over HTTP is a chance for whoever controls the network or the mirror.
  • Archive signing still works: Ubuntu notes that once APT is updated, a compromised mirror can no longer slip packages through.
  • Your website itself isn't the target (WordPress, Drupal or your app): the risk sits in the operating system of the server hosting it.

How to tell if you're affected

If you run a VPS or your own server with Debian or Ubuntu:

  1. Check your version: `apt list --installed '?source-package(^apt$)'` (the command Ubuntu gives) and compare it with the list above.
  2. Update with retries off. Ubuntu recommends setting retries to zero while installing the fix: `sudo apt update && sudo apt upgrade -o Acquire::Retries=0`.
  3. If you have automatic updates, on Ubuntu (unattended-upgrades, on by default since 16.04) the fix lands within 24 hours, according to Ubuntu. Still worth checking the version.
  4. If your server sits on a network you don't control, Ubuntu suggests switching package sources from `http://` to `https://` before updating; some community mirrors don't support HTTPS, so make sure `apt update` runs without errors.

If your site is on shared hosting: this is your provider's job. Ask in writing: «Do your servers run Debian or Ubuntu? Is APT already patched against CVE-2026-109518?»

If you build container images on Debian or Ubuntu that install packages with apt, this article's recommendation is to rebuild them on a base image that already ships the fixed version.

Related: Critical Linux Kernel Flaw: What to Check on Your Server

Sources

Updates: if Debian fixes the testing branch or exploitation is confirmed, it will be added here with a link.