CVE-2026-109518 is a flaw in APT, the package manager on Debian, Ubuntu and their derivatives. The CVE record says an attacker who can manipulate HTTP traffic between an APT client and its archive server can trick the client into installing an unverified package. The result is code execution as root. Debian and Ubuntu shipped fixed builds, and the NVD record was published on 4 November 2026.
This explainer follows the mechanism the sources describe, the conditions that must line up, and the checks worth running. The short version is to upgrade apt itself first, over a network path you trust.
What Breaks Between Verifying and Installing a Package?
APT downloads a package, verifies it, then hands it to the installer, which runs as root. The Debian advisory places the flaw in the gap between those two steps. It says improper file handling when resuming an HTTP download lets a man-in-the-middle attacker replace a package after verification.
The advisory names a second weakness. APT can merge two different package downloads after an HTTP redirect gives them the same URI. The CVE record adds that the flaw comes from the reuse of hard links, which are extra directory names for one and the same file. Debian credits Max Justicz with the discovery.
- APT install starts a downloadClientasks for the package over HTTP
- Attacker or malicious mirror repliesNetworksends a redirect
- Two downloads share one URIClientfollows the redirect and retries
- A hard-linked file is reusedClientfile handling merges the downloads
- Attacker content lands after verificationNetworkpackage is swapped
- Installer runs the packageClient
The drawing is our summary of the two sources. They do not publish the exact code path, so the order of the middle steps is a reading of the advisory wording.
Which Conditions Must Line Up?
The CVE record lists three conditions. The attacker must sit on the path between client and archive, which includes a malicious mirror or proxy. The client must follow redirects and retry the download of package files. The setting Acquire::Retries must also be non-zero.
The value 3 is the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS, so those releases meet the last condition out of the box. The record says older releases are unaffected in a default configuration. A host that sets a non-zero Acquire::Retries by hand falls inside the affected ranges the record lists, which reach back to apt 1.0.1 builds on Ubuntu. That reading is ours.
- Attack Vector
- Network AV:N
- Attack Complexity
- Low AC:L
- Attack Requirements
- Present AT:P
- Privileges Required
- None PR:N
- User Interaction
- Passive UI:P
- Vulnerable System Confidentiality
- High VC:H
- Vulnerable System Integrity
- High VI:H
- Vulnerable System Availability
- High VA:H
- Subsequent System Confidentiality
- None SC:N
- Subsequent System Integrity
- None SI:N
- Subsequent System Availability
- None SA:N
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N The vector marks attack requirements as present and user interaction as passive, which fits the conditions above. NVD lists the weakness types CWE-62 and CWE-367. The NVD record carries no CVSS 3.1 score, and its analysis status was still Received when we read it on 4 November 2026.
What Did the Fix Change?
Upstream APT 3.3.6, dated 4 November 2026, lists a security update titled download verification bypass. The entry reads: methods/*.cc: Open target files exclusively. Ubuntu’s apt 3.2.1ubuntu0.1 for 26.04 LTS carries the same entry in a changelog dated 2 November 2026.
Our reading is that exclusive opening makes a download method refuse to write into a file that already exists, which removes the shared file the attack relies on. The sources do not spell this out. Debian adds that the update also addresses several out-of-bounds access issues, and the apt 3.3.6 changelog lists among them rejecting a .deb with no Version field.
Which Versions Carry the Fix?
The table follows the Debian entry in the NVD record, with the Debian releases that the Debian security tracker and advisories name. Debian forky lists apt 3.3.5 as vulnerable and shows no fixed version yet.
| Affected apt range (NVD) | First fixed version | Named by the sources |
|---|---|---|
| 0 to before 1.2.36 | 1.2.36 | |
| 1.4.0 to before 1.4.12 | 1.4.12 | |
| 1.6.0 to before 1.6.19 | 1.6.19 | |
| 1.8.0 to before 1.8.2.4 | 1.8.2.4 | |
| 1.8.3 to 1.8.5 | No fixed version in the record | |
| 2.0.0 to before 2.0.12 | 2.0.12 | |
| 2.2.0 to before 2.2.5 | 2.2.5 | |
| 2.4.0 to before 2.4.15 | 2.4.15 | |
| 2.6.0 to before 2.6.2 | 2.6.2 | Debian 12 bookworm, DLA-4880-1 |
| 2.8.0 to before 2.8.4 | 2.8.4 | |
| 3.0.0 to before 3.0.4 | 3.0.4 | Debian 13 trixie, DSA-6607-1 |
| 3.2.0 to before 3.2.1 | 3.2.1 | |
| 3.3.0 to before 3.3.6 | 3.3.6 | Debian unstable |
For Ubuntu, the NVD record lists these fixed builds by apt series: 3.3.3ubuntu0.1, 3.2.1ubuntu0.1, 2.8.4ubuntu0.1, 2.4.15ubuntu0.1, 2.0.12+esm1, 1.6.19+esm1, 1.2.36+esm1 and 1.0.1ubuntu2.24+esm4. The record does not map them to release names. When we read it, Ubuntu’s CVE page still marked every release from 14.04 LTS to 26.10 as vulnerable. Confirm your build in Ubuntu notice USN-8996-1, which the record references.
Who Is Exposed in Practice?
The sources do not rank environments, so this section is our reading of the conditions. Exposure needs an attacker who can alter HTTP traffic between a host and its archive. That covers untrusted Wi-Fi, a compromised proxy or caching mirror, and a mirror added to a host without review.
Build servers, container image builds and fleets that pull packages through one shared proxy deserve the first look. One compromised path then reaches many hosts, and each install runs as root. The sources do not say whether HTTPS mirrors change exposure, so we recommend patching whatever the mirror scheme.
What Should You Check First?
- Upgrade apt on every host with
apt updateandapt install --only-upgrade apt, run from a network path you trust. The client doing the download is the vulnerable part. - Confirm the build with
apt --versionagainst the table, and withzgrep CVE-2026-109518 /usr/share/doc/apt/changelog.Debian.gzwhere the package changelog lists the fix. - Read the retry setting with
apt-config dump | grep -i retries. A non-zero value meets the record’s condition. SettingAcquire::Retries "0";in a file under/etc/apt/apt.conf.d/is a stopgap of our own, since the sources name the upgrade as the fix. - List mirrors and proxies with
grep -rE '^(deb|URIs)' /etc/apt/sources.list /etc/apt/sources.list.d/andapt-config dump | grep -i proxy. Remove any you cannot account for. - Compare cached packages with the index:
apt-cache show PACKAGE=VERSION | grep ^SHA256againstsha256sum /var/cache/apt/archives/FILE.deb. Then review/var/log/apt/history.logfor installs made over untrusted networks.
Hosts that installed packages over untrusted paths before updating are the ones to review first. Our ATT&CK mapping is T1557 Adversary-in-the-Middle; read the adversary-in-the-middle glossary entry for the technique and the patch management entry for rollout order. Our Ubuntu kernel host triage post shows the same patch-then-verify flow on Ubuntu, and the vulnerability management guide covers inventory.
What Do CISA and the KEV Catalog Say About Exploitation?
CISA’s SSVC entry inside the NVD record, timestamped 4 November 2026, lists exploitation as none, automatable as no and technical impact as total. CVE-2026-109518 is not in the CISA Known Exploited Vulnerabilities catalog as of its 4 November 2026 release. Both are snapshots from disclosure day and can change.