Debian’s package tooling has a flaw that lets a network attacker slip an unverified package past the archive and have it installed with root rights. Ubuntu’s severity call landed at High, with a CVSS score of 7.7 in tow.
Tracked as CVE-2026-109518, the issue was disclosed by Debian on November 4 and credited to Max Justicz. Ubuntu’s read is that the adversary must sit on the path between client and archive, a slot a hostile mirror or proxy can fill, with several download conditions also required.
The hard link problem
The root cause sits in how APT handles HTTP redirects combined with resumed downloads. Two fetches can share a URI after a redirect, and file handling on an interrupted transfer then lets an attacker swap the payload once verification has run. Debian’s advisory describes improper file handling during resume as enabling a man-in-the-middle to replace a package post-check, followed by arbitrary code execution as root. Since every package installs with root rights, substitution alone is enough.
Check one setting first
Exposure hinges on APT’s Acquire::Retries value. A non-zero retry count opens the window, shipped as default since version 2.3.2, so Debian 12 and Ubuntu 22.04 LTS onward carry it. Earlier releases sit safe unless a script forced retries.
Fixes exist. Debian 13 takes APT 3.0.4 and Debian 12 gets 2.6.2, while Ubuntu shipped patched builds for 22.04, 24.04, 26.04 and 26.10, the last same-day as its advisory. The code change, authored by developer Julian Andres Klode on October 12, has the downloader open destination files exclusively and unlink them before copying, so writes no longer follow pre-existing hard links.
Until fleets are current, disable retries during cleanup, pull packages over HTTPS mirrors, and check whether legacy hosts forced retries.
