APT developers: "critical file verification bypass". Ubuntu (Canonical): priority High, CVSS v4.0 base score 7.7. KEV status: CVE-2026-109518 is not in CISA's KEV catalog (catalog version 2026.11.03).
On 4 November 2026 the APT developers published a security update for CVE-2026-109518 in APT, the package manager on Debian, Ubuntu and their derivatives. They call it a "critical file verification bypass". Someone who can tamper with the HTTP traffic between a server and its package mirror can get APT to install a package it never verified. Packages install as root, so a successful attack means code execution as root. Debian has shipped fixes for bookworm, trixie and sid; forky (testing) is still vulnerable. Ubuntu's CVE page still lists its releases as vulnerable.
Technical Information
According to the APT advisory, a remote attacker can bypass checks on downloaded packages by combining HTTP redirects with ordinary temporary server errors that make APT retry the download. During the retry, APT overwrites existing hardlinks with a payload the attacker picks. Ubuntu's CVE page says the attacker has to be on-path: able to manipulate HTTP traffic between the APT client and the archive, for example by running a malicious mirror or proxy. The attack only starts when a package install triggers a download.
The attack depends on APT retrying downloads, controlled by Acquire::Retries. The APT developers say retries have been on by default since APT 2.3.2. Ubuntu says the default value of 3 applies from Debian 12 (bookworm) and Ubuntu 22.04 LTS onward. On older releases such as Debian 11 and Ubuntu 20.04, a default configuration is not affected. They are exposed only if retries were turned on, which the APT developers say many user scripts may have done. Max Justicz reported the bug.
Canonical rates the issue Ubuntu priority High and publishes its own CVSS v4.0 base score of 7.7. The advisories we reviewed do not report exploitation in the wild or public exploit code. The same APT release also bundles several out-of-bounds memory-access fixes and a memory-exhaustion fix. The developers expect no direct impact beyond denial of service from those.
Affected Product Versions
- Debian 12 bookworm: fixed in apt 2.6.2 (DLA-4880-1); 2.6.1 vulnerable.
- Debian 13 trixie: fixed in apt 3.0.4 (DSA-6607-1); 3.0.3 vulnerable.
- Debian forky (testing): 3.3.5 still vulnerable per the tracker at time of writing.
- Debian sid: fixed in 3.3.6.
- Upstream APT fixed branches: 1.2.36, 1.4.12, 1.6.19, 1.8.2.4, 2.0.12, 2.2.5, 2.4.15, 2.6.2, 2.8.4, 3.0.4, 3.2.1.
- Ubuntu: when we checked on 4 November, Ubuntu's CVE page listed apt as Vulnerable on 26.10, 26.04 LTS, 24.04 LTS, 22.04 LTS, 20.04 LTS, 18.04, 16.04 and 14.04, and there was no Ubuntu Security Notice yet. The APT maintainer says updates for the Ubuntu and Ubuntu Pro channels "are being released". Check Ubuntu's page for the current status before you treat any Ubuntu release as fixed.
Workaround and Mitigation
- Update apt now wherever a fixed package exists (
apt update && apt install --only-upgrade apt), and confirm the installed version against the list above. - Pull packages only from trusted mirrors over trusted network paths. Avoid unknown proxies and mirrors you don't control, especially on hosts that are still unpatched.
- Until Ubuntu ships fixed packages, consider disabling retries (
Acquire::Retries "0";). Ubuntu's CVE page says the attack requires a non-zero setting. Using zero as a stopgap is our reading of the advisories, not vendor-issued guidance, so test it first. - On older releases, check whether scripts or config set
Acquire::Retries. - Rebuild container base images and golden images once fixed apt is available, so new builds don't download packages through the vulnerable client.
Indicators of Compromise
The advisories publish no indicators of compromise. We have none to share, and none are invented here.
What to do with your vendors today
Many vendors that run Debian- or Ubuntu-based servers or ship container images depend on APT. Ask your Debian- and Ubuntu-based suppliers three things:
- Have their hosts and base images moved to a fixed apt (for example bookworm 2.6.2 or trixie 3.0.4)? For Ubuntu, what is their plan while fixes roll out?
- Do their build and production systems pull packages through unpinned, third-party, or untrusted mirrors and proxies?
- When do their base images rebuild, and will the next rebuild include the fixed apt?
Ask for dates and evidence rather than a yes. Our platform validates vendor claims against live attack-surface signal and chases findings to closure under your approval.
Need help working through Linux and container-image suppliers exposed to CVE-2026-109518? Our team can help you prioritize them and track their answers. Talk to an expert
Sources
- APT developers, APT-2026-11-01 security update (deity list): https://lists.debian.org/deity/2026/11/msg00005.html
- Debian Security Tracker, CVE-2026-109518: https://security-tracker.debian.org/tracker/CVE-2026-109518
- Debian Security Advisory DSA-6607-1 (trixie): https://lists.debian.org/debian-security-announce/2026/msg00526.html
- Debian LTS Advisory DLA-4880-1 (bookworm): https://lists.debian.org/debian-lts-announce/2026/11/msg00004.html
- Ubuntu Security, CVE-2026-109518: https://ubuntu.com/security/CVE-2026-109518
- KEV status, checked 4 Nov 2026: CVE-2026-109518 is not in CISA's Known Exploited Vulnerabilities Catalog (catalog version 2026.11.03). Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
