Serious APT Flaw Lets Attackers Swap Trusted Linux Packages and Gain Full Control

A critical flaw in APT, the package manager for Debian and Ubuntu, could let an attacker swap a checked software package for their own. The attacker's code then runs as root, the highest level of access on a Linux system. Advisories from Debian, Ubuntu and APT's developers were published on November 4. The flaw is tracked as CVE-2026-109518, and Ubuntu rates it high priority with a CVSS 4.0 score of 7.7. Max Justicz reported it.

The attacker must be able to change the HTTP traffic between APT and the package server, such as through a malicious mirror or proxy. The attack runs when a computer installs a package, and it relies on APT retrying failed downloads. Attackers use HTTP redirects and ordinary temporary server errors to trigger those retries. APT does this by default from Debian 12 and Ubuntu 22.04 onward. Older releases such as Debian 11 and Ubuntu 20.04 are not exposed by default, but APT's developers warn that many user scripts may have enabled the retry setting anyway. Ubuntu says distributions built on Debian and Ubuntu are also affected.

Debian has released fixed versions, and APT's developers have published version 2.2.5 for Debian 11. Ubuntu released new builds for four releases, though at 15:46 UTC it still marked all eight releases it tracks as vulnerable. The advisories do not describe attacks in the wild or offer a workaround, and they do not say whether HTTPS package sources are exposed.