Debian and Ubuntu APT Flaw Lets MitM Attackers Swap Verified Packages and Run Code as Root
A flaw in APT, the package manager for Debian and Ubuntu, allows an attacker who can modify package downloads to swap a checked package for their own. The attacker's code then runs as root, according to advisories that Debian, Ubuntu, and APT's developers published on November 4. The attack needs APT to retry failed downloads, which it does by default from Debian 12 and
A flaw in APT, the package manager used by Debian and Ubuntu, enables attackers to intercept package downloads and replace legitimate verified packages with malicious ones. When these compromised packages are installed, the attacker's code is executed with root privileges, according to advisories issued on November 4 by Debian, Ubuntu, and APT's developers.
The vulnerability requires APT to retry failed downloads, which occurs by default in Debian 12 and Ubuntu 22.04. Debian has released fixed versions of APT addressing the flaw, identified as CVE-2026-109518. Ubuntu and its Ubuntu Pro subscription service are also releasing updates to address the issue. While Ubuntu 14.04 users with Ubuntu Pro can access one of these updates, older releases, such as Debian 11 and Ubuntu 20.04, are not automatically exposed to the fix.
However, many user scripts may have inadvertently enabled the retry setting, Acquire::Retries, on these older releases, according to Ubuntu's developers. Debian's testing branch was still using the vulnerable version 3.3.5 at the time of the advisory's release. For Debian 11, which reached its end of life on August 31, APT developers have published a fixed version, 2.2.5.
Ubuntu has rated the flaw as high priority, assigning it a CVSS 4.0 score of 7.7, and has indicated that other distributions built on Debian and Ubuntu are also affected, though no specific names were provided. Ubuntu has published new APT builds for four of its releases in its security archive, listing them from Ubuntu 14.04 LTS to 26.10.
The vulnerability can be exploited by anyone capable of tampering with HTTP traffic between APT and the package server, including malicious mirrors or proxies. The attack occurs during package installation, triggered by HTTP redirects and ordinary temporary server errors that prompt APT to retry the download. Max Justicz reported the flaw.
The advisory reports do not provide details on any attacks exploiting the vulnerability nor offer workarounds for systems that cannot update immediately. Instead, they focus on describing the potential HTTP-based attack and do not clarify whether HTTPS package sources are exposed.
Written by urgent.news from The Hacker News's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
