APT, the package manager used by Debian, Ubuntu and their derivatives, has a high-severity vulnerability that can let an attacker who manipulates HTTP traffic between a system and its package archive cause installation of an unverified .deb package with root privileges. Tracked as CVE-2026-109518, the flaw carries a CVSS 4.0 score of 7.7.
The bug involves APT’s hard-link handling when redirects and retried downloads occur together. APT can merge different package downloads after a redirect gives them the same URI, allowing an on-path attacker to replace a package after verification. Exploitation requires a package installation and a retry of a failed download; Ubuntu says retries are enabled by default starting with Ubuntu 22.04 and older releases are affected only when the setting is configured to a non-zero value.
Debian fixed the flaw in APT 3.0.4 for Debian 13 “Trixie” and 2.6.2 for Debian 12 “Bookworm,” according to its security advisory and LTS advisory. Ubuntu’s USN-8996-1 lists fixes in 3.3.3ubuntu0.1 for 26.10, 3.2.1ubuntu0.1 for 26.04 LTS, 2.8.4ubuntu0.1 for 24.04 LTS and 2.4.15ubuntu0.1 for 22.04 LTS. Ubuntu Pro fixes are also available for 20.04 and older supported LTS releases.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
