{"slug": "debian-ubuntu-patch-apt-flaw-that-could-hand-attackers-root", "title": "Debian, Ubuntu patch APT flaw that could hand attackers root", "summary": "Debian disclosed CVE-2026-109518 on November 4, an APT package-manager flaw credited to researcher Max Justicz that lets an on-path attacker install an unverified package and execute arbitrary code as root; Ubuntu rated it High with a CVSS score of 7.7. The bug stems from APT merging two package downloads after an HTTP redirect gives them the same URI and mishandling resumed downloads, and it depends on the Acquire::Retries setting being non-zero, the default since APT 2.3.2 (Debian 12 and Ubuntu 22.04 LTS onward). Debian fixed it in APT 3.0.4 for Debian 13 (Trixie) and 2.6.2 for Debian 12 (Bookworm), Ubuntu shipped patches for 22.04 LTS, 24.04 LTS, 26.04 LTS and 26.10, and developer Julian Andres Klode's October 12 commit changed the download code to open destination files exclusively and unlink existing files before copying partial content.", "body_md": "Linux administrators’ trust in package managers is being tested by a newly disclosed vulnerability in APT, the package management system used by Debian, Ubuntu, and their derivatives, that could allow attackers to install unverified software with root privileges.\n\nTracked as [CVE-2026-109518](https://nvd.nist.gov/vuln/detail/cve-2026-109518), the vulnerability could let an attacker positioned to manipulate HTTP traffic between an APT client and an archive server install an attacker-controlled package without verification.\n\nDebian disclosed the flaw on November 4, crediting security researcher Max Justicz. Ubuntu subsequently rated it High, assigning it a CVSS score of 7.7.\n\n“I used an AI for two hours and found a zero-day that would let a nation-state hack any server running stock Ubuntu,” Justicz said in an X [post](https://x.com/just1cz/status/2118009777922228361). Successful exploitation could allow arbitrary [code execution](https://www.csoonline.com/article/4164250/critical-cursor-bug-could-turn-routine-git-into-rce.html) with root privileges on a vulnerable machine.\n\nBoth distributions have issued fixes.\n\nThe problem lies in APT’s handling of HTTP redirects and resumed downloads.\n\n“APT can merge two different package downloads after an HTTP redirect gives them the same URI,” Debian’s [advisory](https://lists.debian.org/debian-security-announce/2026/msg00526.html) said. “Improper file handling when resuming an HTTP download allows a man-in-the-middle ([MitM](https://www.csoonline.com/article/566905/man-in-the-middle-attack-definition-and-examples.html)) attacker to replace a package after verification, resulting in the execution of arbitrary code as root.”\n\nAPT developers provide a more [detailed](https://lists.debian.org/deity/2026/11/msg00005.html) explanation: an attacker can exploit redirects and transient HTTP server errors that trigger download retries, causing APT to override existing hard links with a chosen payload. Because Debian packages are installed with root privileges, successfully substituting a package can lead to arbitrary code execution as root.\n\nUbuntu [described](https://ubuntu.com/security/CVE-2026-109518) the required attack position as an on-path attacker able to manipulate traffic between the package client and the archive server. A malicious mirror or proxy could provide that position, but the attack requires specific download conditions.\n\nThe vulnerability depends on APT’s Acquire::Retries setting being non-zero. APT developers [say](https://seclists.org/oss-sec/2026/q4/519) this has been the default since version 2.3.2, although scripts may have enabled retries on older installations. Ubuntu specifies that the default retry value of three applies from Debian 12 (Bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish) onward. Older releases are not exposed by default, but may still be vulnerable if retries have been enabled.\n\nDebian 13 (Trixie) is [patched](https://security-tracker.debian.org/tracker/CVE-2026-109518) in APT 3.0.4, while Debian 12 (Bookworm) received the fix in version 2.6.2. Ubuntu has also released patched packages for supported releases, including 22.04 LTS, 24.04.LTS, and 26.04 LTS. Ubuntu 26.10 was also affected, with its fix being published when Ubuntu’s November 4 advisory appeared. The fix addresses the underlying file-handling issue. In a commit authored on October 12, APT developer Julian Andres Klode [changed](https://salsa.debian.org/apt-team/apt/-/commit/5af16a8ad0f155233dfb10b7c92ad1903112ef79?pow_referer=) the download code to open destination files exclusively, unlinking existing files before copying over any partially downloaded content.\n\nThe change prevents downloads from writing through existing hard links, which could otherwise redirect writes to unintended files.\n\nUbuntu [recommends](https://ubuntu.com/blog/apt-vulnerability-fixes-available) updating APT and temporarily disabling retries during remediation. It also advises using HTTPS for package downloads, which protects against traffic manipulation in this attack scenario. For enterprise security teams, the priority is to identify vulnerable installations, check retry configurations, and ensure patched packages reach production systems and the Linux images used to provision them.", "url": "https://wpnews.pro/news/debian-ubuntu-patch-apt-flaw-that-could-hand-attackers-root", "canonical_source": "https://www.csoonline.com/article/4245109/debian-ubuntu-patch-apt-flaw-that-could-hand-attackers-root.html", "published_at": "2026-11-05 12:20:35+00:00", "updated_at": "2026-11-05 12:55:23.522475+00:00", "lang": "en", "topics": ["ai-safety"], "entities": ["Debian", "Ubuntu", "APT", "Max Justicz", "Julian Andres Klode", "CVE-2026-109518"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/debian-ubuntu-patch-apt-flaw-that-could-hand-attackers-root", "markdown": "https://wpnews.pro/news/debian-ubuntu-patch-apt-flaw-that-could-hand-attackers-root.md", "text": "https://wpnews.pro/news/debian-ubuntu-patch-apt-flaw-that-could-hand-attackers-root.txt", "jsonld": "https://wpnews.pro/news/debian-ubuntu-patch-apt-flaw-that-could-hand-attackers-root.jsonld"}}