APT Flaw in Debian and Ubuntu Allows MitM Attackers to Swap Verified Packages

Critical APT Vulnerability Discovered

A security flaw, identified as CVE-2026-109518, has been found in APT, the package manager used by Debian and Ubuntu distributions. This vulnerability enables an attacker to intercept and replace legitimate package downloads with their own malicious code. If successful, the attacker's code will execute with root privileges on the compromised system.

Attack Mechanism and Conditions

The attack relies on APT's default behavior of retrying failed downloads, a feature enabled by default in Debian 12 and Ubuntu 22.04 and newer. An attacker, positioned to modify HTTP traffic between APT and the package server (e.g., via a malicious mirror or proxy), can use HTTP redirects and temporary server errors to trigger these retries. This allows them to substitute the intended package with a malicious one during the retry process. The attack occurs when the computer attempts to install a package.

Affected Versions and Patches

Debian has released fixed versions of APT to address this flaw. Ubuntu also rates the vulnerability as high priority, with a CVSS 4.0 score of 7.7, and is distributing updates. Ubuntu published new APT builds for Ubuntu 26.10, 26.04 LTS, 24.04 LTS, and 22.04 LTS on November 4. Older releases like Debian 11 and Ubuntu 20.04 are not exposed by default, but user scripts may have enabled the 'Acquire::Retries' setting, making them vulnerable. Updates for Ubuntu Pro subscribers are also available for older versions like Ubuntu 14.04.

Reporting and Unanswered Questions

The flaw was reported by Max Justicz. While advisories from Debian, Ubuntu, and APT developers describe the attack over HTTP, they do not specify whether package sources accessed via HTTPS are also vulnerable. The advisories also do not mention any active exploits of this flaw or provide workarounds for systems that cannot be immediately updated.