The vulnerability, tracked as CVE-2026-109518, affects the Advanced Package Tool (APT) used by Debian and Ubuntu. The defect requires APT to retry failed downloads — a behavior that is the default on Debian 12 and Ubuntu 22.04 onward — and allows an on-path attacker to replace a verified package with malicious content during installation. The issue was reported by Max Justicz and has prompted coordinated advisories from Debian, Ubuntu, and APT's developers.
How the exploit works: HTTP redirects, temporary errors, and retries
According to the published advisories, the attacker must be able to change HTTP traffic between APT and the package server. The exploit uses ordinary HTTP mechanisms — redirects and temporary server errors — to force APT into retrying a download. When APT retries under the vulnerable code paths, the attacker can make APT fetch a different package than the one initially checked, and the attacker's code runs with root privileges when the package is installed.
Which releases are fixed and what Ubuntu released on November 4
Debian has released fixed versions of APT for CVE-2026-109518. For Debian 11 — whose long-term support ended on August 31 — APT's developers published a fixed version, 2.2.5. The source snapshot showed Debian's testing branch still on the vulnerable 3.3.5 as of 14:58 UTC on November 4.
Ubuntu published new APT builds to its security archive at 14:25 UTC on November 4 for four releases:
- Ubuntu 26.10: 3.3.3ubuntu0.1
- Ubuntu 26.04 LTS: 3.2.1ubuntu0.1
- Ubuntu 24.04 LTS: 2.8.4ubuntu0.1
- Ubuntu 22.04 LTS: 2.4.15ubuntu0.1
Despite those uploads, Ubuntu still marked all eight releases it tracks for the flaw — from 14.04 LTS through 26.10 — as vulnerable at 15:46 UTC on November 4. Ubuntu rates the flaw high priority with a CVSS 4.0 score of 7.7 and warns that distributions built on Debian and Ubuntu are affected as well. APT's developers describe the flaw as critical and say updates for Ubuntu and its Ubuntu Pro subscription service are being released; Ubuntu 14.04 users with Ubuntu Pro can already obtain an update.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadWho can exploit this and what limits the attack
Ubuntu's advisory is explicit about the attacker profile: anyone who can change HTTP traffic between APT and the package server — including a malicious mirror or a proxy under an attacker's control. The attack executes during package installation and succeeds because APT's retry logic can be manipulated. Advisories describe the attack flow over HTTP and do not state whether package sources reached over HTTPS are exposed.
Practical constraints: Acquire::Retries and older releases
The vulnerability requires the retry behavior configured by Acquire::Retries. That setting is enabled by default on Debian 12 and Ubuntu 22.04 and later; on older releases such as Debian 11 and Ubuntu 20.04, the setting is not enabled by default, according to Ubuntu. APT's developers caution, however, that many user scripts may have turned on Acquire::Retries on those older releases, which would expose otherwise unaffected systems. None of the three advisory reports describe live exploitation or offer a workaround for systems that cannot update immediately.
What this means for Debian maintainers, Ubuntu users, and enterprise operators
- Debian maintainers: track the fixed APT packages and the state of testing — Debian's testing branch was still running the vulnerable 3.3.5 at 14:58 UTC on November 4, so repositories and downstream images should be inspected and updated where needed.
- Ubuntu users (including Ubuntu Pro subscribers): apply the new APT builds published to the security archive (listed above). Ubuntu has indicated updates are being released and that Ubuntu 14.04 users with Ubuntu Pro can already receive a fix.
- Enterprise operators and downstream distributions: confirm whether Acquire::Retries is enabled in any user scripts or mirror configurations, and review proxy or mirror trust boundaries since a malicious mirror or proxy is an explicit attack vector; Ubuntu notes that distributions built on Debian and Ubuntu are affected as well.
The advisories leave two immediate operational imperatives: deploy the released APT updates where available, and inventory systems for the Acquire::Retries setting and any untrusted mirrors or proxies. The published reports do not describe exploit activity, and they do not say whether HTTPS-protected package sources are affected — questions deployers will want answered as they apply fixes and harden update infrastructure.
https://thehackernews.com/2026/11/debian-and-ubuntu-apt-flaw-lets-mitm.html
