Debian and Ubuntu Patch apt Bug That Gives Network Attackers Root

Debian and Ubuntu patched CVE-2026-109518 on Nov. 4, a flaw in the apt package manager that lets a man-in-the-middle attacker replace a package after its verification and run code as root.

Salvatore Bonaccorso of the Debian Security Team published DSA-6607-1 on Nov. 4 and credited Max Justicz with the report. CVE-2026-109518 is a tracking number for this one flaw. The advisory says that when an HTTP redirect gives two package downloads the same URI, apt can merge them, and that improper file handling when a download resumes lets the attacker swap in a different package after apt has checked it.

What the attacker needs for CVE-2026-109518

Debian's advisory lists three conditions: an HTTP redirect that leaves two downloads sharing a URI, an attacker positioned on the network path, and a download that resumes. Canonical's CVE page words the last condition differently. It says the flaw stems from reused hard links and needs a client that follows redirects and retries downloads, so only clients with a non-zero Acquire::Retries setting are affected. The default is 3 on Debian 12 and Ubuntu 22.04 LTS and later.

Canonical describes the attacker as someone who can manipulate HTTP traffic, such as through a malicious mirror or proxy. Neither page says the flaw has been exploited, and neither lists a workaround.

Canonical rates it High with a CVSS 4.0 score of 7.7, vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H. The score reflects the preconditions rather than the impact. The vector lists attack requirements (AT:P) and user interaction (UI:P), while confidentiality, integrity and availability impact are all High, which matches root code execution.

Fixed versions on Debian and Ubuntu

The Debian security tracker lists the vulnerable and fixed builds below.

Debian release	Vulnerable	Fixed
12 (bookworm)	2.6.1	2.6.2 (DLA-4880-1)
13 (trixie)	3.0.3	3.0.4 (DSA-6607-1)
forky	3.3.5	No fix listed
sid (unstable)	Not listed	3.3.6

Canonical shipped fixes under USN-8996-1 for every supported Ubuntu release.

Ubuntu release	Fixed apt version
26.10	3.3.3ubuntu0.1
26.04 LTS	3.2.1ubuntu0.1
24.04 LTS	2.8.4ubuntu0.1
22.04 LTS	2.4.15ubuntu0.1
20.04 LTS	2.0.12+esm1 (Ubuntu Pro)
18.04 LTS	1.6.19+esm1 (Ubuntu Pro)
16.04 LTS	1.2.36+esm1 (Ubuntu Pro Legacy Support add-on)
14.04 LTS	1.0.1ubuntu2.24+esm4 (Ubuntu Pro Legacy Support add-on)

The Debian advisory also says the update fixes several out-of-bounds access issues, without giving them identifiers.

Where the two advisories differ

Debian names resumed downloads as the trigger. Canonical names retries. Both can be true, since a retry after a failed transfer is a resume, but the pages do not say so. The Debian advisory does not list affected versions, and the tracker shows 2.6.1 on bookworm as vulnerable, which Ubuntu's 22.04 default of 3 retries would also cover.

Canonical also says releases older than 22.04 LTS are unaffected in a default configuration, yet it lists extended-maintenance fixes for 20.04, 18.04, 16.04 and 14.04. A reader running those releases on a customised Acquire::Retries should read the Ubuntu page rather than assume.

The reporter, Max Justicz, describes himself on his homepage as cofounder and chief technology officer of Charge Robotics and points to a separate page for his past security writing. The Terminal found no write-up by him of this flaw.

What to run today

On Debian 13, upgrade apt to 3.0.4; on Debian 12, to 2.6.2. On Ubuntu 24.04 LTS, upgrade to 2.8.4ubuntu0.1. Ubuntu 26.04 LTS users who followed The Terminal's report on sudo-rs 0.2.13 breaking scripts should note that this update is a separate package, apt 3.2.1ubuntu0.1. The fix for Ubuntu 20.04 and older requires an Ubuntu Pro subscription, and Debian forky shows no fixed build yet beyond the sid version 3.3.6. A credit to one researcher on a patch day is also the pattern in Chrome 156's release notes.