APT vulnerability lets attackers install rogue packages as root on Ubuntu and Debian
Canonical released fixes on Wednesday, November 4, for an APT vulnerability, CVE-2026-109518, that can let an attacker slip an unverified package onto a Linux system and run it with root privileges. Debian has patched its supported releases too. APT is the package manager behind Ubuntu, Debian and the distributions built on them, so the fix matters for anyone running Ubuntu 22.04 LTS, Debian 12 or a newer release.
What the flaw does
The bug is in APT's HTTP download code. According to Ubuntu's security notice, APT mishandled hard links when it followed redirects and retried package downloads. An attacker who can tamper with the HTTP traffic between a computer and a package server could use that to make APT install an attacker-controlled .deb file. Package install scripts run as root, so that means full control of the machine.
Canonical says the attack also works from a malicious package mirror or proxy. The flaw affects apt, apt-get, aptitude and Ubuntu's graphical package tools. Snap packages are not affected, and neither are other download methods such as FTP.
Max Justicz found and reported the vulnerability. Canonical rates it high severity, with a CVSS 4.0 score of 7.7. Neither Canonical nor Debian says it has been used in attacks.
Which versions are affected
The attack only works when APT is set to retry failed downloads, a setting called Acquire::Retries. That setting defaults to 3 starting with Ubuntu 22.04 LTS and Debian 12, so those releases and everything newer are exposed out of the box. Older releases are only affected if someone turned retries on.
Ubuntu has fixed APT in every release from 14.04 LTS to 26.10. The fixed versions for current releases are:
| Release | Fixed APT version |
|---|---|
| Ubuntu 26.10 | 3.3.3ubuntu0.1 |
| Ubuntu 26.04 LTS | 3.2.1ubuntu0.1 |
| Ubuntu 24.04 LTS | 2.8.4ubuntu0.1 |
| Ubuntu 22.04 LTS | 2.4.15ubuntu0.1 |
| Debian 13 (trixie) | 3.0.4 |
| Debian 12 (bookworm) | 2.6.2 |
Fixes for Ubuntu 20.04 and 18.04 are available only through Ubuntu Pro, which Canonical offers free for up to 5 machines. Ubuntu 16.04 and 14.04 also need Ubuntu Pro's Legacy Support add-on. Debian published the trixie fix as DSA-6607-1 and the bookworm fix as Debian LTS advisory DLA-4880-1.
How to update safely
Because the bug sits in the tool that installs updates, Canonical suggests turning off retries for the update itself. Its recommended command is:
sudo apt update && sudo apt upgrade -o Acquire::Retries=0
To check what you have installed, run apt list --installed '?source-package(^apt$)' and compare the version with the table above. On Ubuntu systems with unattended upgrades turned on, which is the default from 16.04 LTS onward, Canonical says the fix installs within 24 hours.
If you're worried about the network path, Canonical says you can also switch your Ubuntu archive addresses from http:// to https://, since encrypted connections block this kind of on-path tampering. It notes that some community mirrors don't support HTTPS and that HTTPS is no substitute for installing the update.
What it means for you
If you run Ubuntu 22.04 LTS, Debian 12 or anything newer, install the APT update today, using the retry-free command above if you update by hand. An attack requires someone who can tamper with your connection to the package server or who controls the mirror you download from. Ubuntu 20.04 and earlier are not exposed unless retries were turned on, but those releases only get security fixes through Ubuntu Pro, so this is a good moment to move an older PC to a supported release. Our guide to lightweight Linux distros lists current options that still run well on older hardware.