Title: APT Vulnerability Lets On-Path Attackers Install Unverified Packages and Execute Code as Root
Summary:
A flaw in APT, the package manager used by Debian, Ubuntu and their derivatives, lets an on-path attacker — anyone able to manipulate the HTTP traffic between an APT client and its archive, including a malicious mirror or proxy — trick a client into installing an attacker-controlled, unverified package during an install, landing root-level code execution. Ubuntu tracks it as CVE-2026-109518 at high priority with a CVSS 4.0 base score of 7.7. The bug stems from the reuse of hard links and requires the client to follow redirects and retry failed downloads; a non-zero Acquire::Retries setting is the trigger, and the default of 3 applies from Debian 12 and Ubuntu 22.04 onward, so older releases are unaffected in default configurations (though user scripts may have enabled retries there too, per APT’s developers). Max Justicz reported the flaw, and Debian, Ubuntu and the APT developers published advisories on November 4. Ubuntu pushed fixed APT builds for four releases — 3.3.3ubuntu0.1 (26.10), 3.2.1ubuntu0.1 (26.04 LTS), 2.8.4ubuntu0.1 (24.04 LTS) and 2.4.15ubuntu0.1 (22.04 LTS) — with Ubuntu Pro fixes down to 14.04 LTS, and APT’s developers published 2.2.5 for Debian 11. None of the advisories describes attacks exploiting the flaw or offers a workaround, and the advisories describe the attack over HTTP without stating whether HTTPS-based sources are exposed.
References: