Debian and Ubuntu have patched a flaw in APT, the package manager used by Debian, Ubuntu and their derivatives, that could let an attacker replace a verified software package with a malicious one and gain root access. The flaw, CVE-2026-109518, rated High with a CVSS 4.0 score of 7.7, was disclosed on 4 November. It was found by security researcher Max Justicz.

How the package swap works

The problem lies in APT's handling of HTTP redirects and resumed downloads. According to Debian's advisory, APT can merge two different package downloads after an HTTP redirect gives them the same address. Sloppy file handling when resuming a download then lets an attacker positioned on the network path replace a package after APT has already verified it — so the signature check no longer protects what actually gets installed.

Because Debian packages install with root privileges, a successful swap can lead to arbitrary code execution as root. The attack needs an on-path attacker able to manipulate HTTP traffic between the system and its archive server, such as a malicious mirror or proxy, and it only bites when a download is retried after a failure. That retry condition is the default on modern systems: retries are switched on by default from Ubuntu 22.04 LTS and Debian 12 onwards.

Fixes available now

Both distributions released fixes on 4 November. Debian 13 (Trixie) is patched in APT 3.0.4 and Debian 12 (Bookworm) in APT 2.6.2, with the upstream fix in APT 3.3.6. Ubuntu's fixed builds include 2.4.15ubuntu0.1 for 22.04, 2.8.4ubuntu0.1 for 24.04, 3.2.1ubuntu0.1 for 26.04 and 3.3.3ubuntu0.1 for 26.10, with extended support builds for older releases.

Update APT itself first with retries switched off for that single run, using Acquire::Retries=0, and prefer HTTPS mirrors. No exploitation in the wild has been reported.

Sources: CSO Online, Debian, Ubuntu patch APT flaw that could hand attackers root, 5 November 2026; GamingOnLinux, Debian, Ubuntu and derivatives hit by APT flaw that could give attackers root access, 5 November 2026; ICHI Global, ICHI Daily, 5 November 2026.