Debian and Ubuntu APT Flaw Allows Root Code Execution via Hijacked Software Updates
A vulnerability in Debian's APT package manager, CVE-2026-109518, enables network attackers to replace verified software packages with malicious versions, leading to root code execution.
A critical vulnerability within Debian's Advanced Package Tool (APT), the ubiquitous package manager for Debian and its derivatives like Ubuntu, has been disclosed, allowing network attackers to potentially hijack software updates and execute arbitrary code with root privileges. The flaw, tracked as CVE-2026-109518, was discovered by researcher Max Justicz and announced by Debian on November 4, 2026.
The vulnerability exploits a specific interaction between APT's handling of HTTP redirects and its retry mechanism for interrupted downloads. When APT resumes a download that was previously interrupted, it can incorrectly handle the file. This creates a narrow window where an attacker, positioned as a man-in-the-middle between the client and the package repository, can substitute a malicious package for the legitimate, verified one before it is installed. This bypasses APT's built-in signature verification, allowing malicious code to be installed with the highest level of system access.
The attack requires the attacker to be on the same network as the target, or to control a rogue proxy or a compromised mirror. While this limits the attack surface compared to a purely remote exploit, the prevalence of compromised network infrastructure, such as public Wi-Fi, hijacked routers, and malicious mirrors, makes such scenarios realistic. The exploit is contingent on APT's Acquire::Retries setting being greater than zero, which is the default configuration for Debian 12 (bookworm) and Ubuntu 22.04 LTS, making these systems particularly vulnerable out-of-the-box.
Debian has released patches for affected systems. Debian 12 (bookworm) is fixed in APT version 2.6.2, and Debian's testing and unstable branches are addressed in version 3.3.6. Ubuntu and other derivatives will require their own specific patches from their respective vendors. Users are strongly advised to check their distribution's security advisories and update their APT packages as soon as possible.
This is not the first time APT has faced such a threat. In 2019, Justicz also discovered a similar remote code execution vulnerability (CVE-2019-3462) that exploited redirects. The mitigation then involved disabling HTTP redirects via Acquire::http::AllowRedirect=false. While this new vulnerability is distinct, it underscores the inherent risks associated with handling redirects and download retries in package management systems.
To mitigate the risk on unpatched systems, administrators can temporarily set Acquire::Retries to 0. However, this may impact update reliability on unstable network connections. The most effective defense remains applying the official patches provided by Debian and Ubuntu. Users should also prioritize using trusted networks, especially when performing system updates, and prefer HTTPS repositories to make man-in-the-middle attacks more difficult.
While no public reports of active exploitation have surfaced yet, the potential impact of a compromised package manager is severe, as it can lead to the complete compromise of a server. Prompt patching and adherence to secure network practices are crucial to prevent attackers from leveraging this vulnerability to gain unauthorized root access.
The vulnerability, tracked as CVE-2026-109518, affects Debian 12 and Ubuntu 22.04 and later by default, as these versions enable package download retries. While older Debian and Ubuntu releases are not exposed by default, the retry mechanism can be enabled via configuration, potentially exposing them as well. Ubuntu has rated the flaw as high priority with a CVSS 4.0 score of 7.7, and has begun releasing updates for affected Ubuntu releases.