APT's November 2026 Download Verification Bypass: CVE-2026-109518

#Overview

APT, the package manager that installs software on Debian, Ubuntu, and every distribution built on them, has a flaw that lets an attacker on the network path swap a package APT has already verified for one of their own. The installed package then runs its install scripts as root. CVE-2026-109518 (opens in a new tab) was published on November 4, 2026, rated High, CVSS 4.0 7.7, by Canonical, which issued the CVE. Debian shipped fixed APT for Debian 13 (3.0.4, DSA-6607-1) and Debian 12 (2.6.2, DLA-4880-1), and APT upstream released 3.3.6. Ubuntu has built fixes for 22.04, 24.04, 26.04, and 26.10, but as of 12:50 PM CST, November 4 its archive isn't serving them yet. The CVE record's verdict: an attacker "can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges."

Why it's urgent: APT runs as root on effectively every Debian and Ubuntu server, desktop, and container build, and by default it fetches packages over plain HTTP. We checked the official debian and ubuntu Docker images for Debian 11 through 13 and Ubuntu 20.04 through 24.04 on November 4: every one ships a vulnerable APT and HTTP-only package sources. The attack needs someone who can tamper with that traffic, such as a hostile Wi-Fi network, a compromised router, a malicious mirror, or a proxy. And on Ubuntu, the fix isn't installable yet. See the timeline.

#Key facts

#Who is affected

The CVE record lists every APT release line from the earliest on as affected. Whether a machine is exposed in practice depends on its release, because the attack needs APT to retry failed downloads: the setting Acquire::Retries must be above zero, and "the value 3 is the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older releases are unaffected in a default configuration."

#Distribution status

Each distribution ships its own APT build under its own version number. As of 12:50 PM CST, November 4:

#Not just Debian

The CVE record names "Debian, Ubuntu, and derivative Linux distributions." Anything that installs packages with APT is in scope. Where a derivative's fix comes from depends on whose APT it runs, so we checked each one's own package repository:

• APT from Ubuntu's archive: Linux Mint, Pop!_OS, Zorin OS, elementary OS, KDE neon, and Ubuntu's official flavors, such as Kubuntu and Xubuntu. They get the fix when Ubuntu's archive starts serving it.
• APT from Debian's archive: LMDE (Linux Mint Debian Edition), 64-bit Raspberry Pi OS, MX Linux, Proxmox VE, and the Linux environment on ChromeOS. On releases built on Debian 12 or 13, Debian's fix arrives with a normal upgrade. Parrot OS 7 already carries Debian's fixed 3.0.4 in its own repository.
• Their own APT build: Kali Linux (3.3.3+kali1), Devuan (3.0.3devuan1 in Devuan 6, 2.6.1devuan1 in Devuan 5), PureOS (2.6.1pureos1 in PureOS 11), and 32-bit Raspberry Pi OS, whose packages Raspbian rebuilds (3.0.3 and 2.6.1). None had a fixed build in its repository. Watch each one's security notices.

Ubuntu and Debian on Windows Subsystem for Linux use the same archives as on a server. For a distribution not listed here, apt-cache policy apt shows the installed version and the repository it came from.

APT also runs in places that are easy to forget:

• Container images. The official debian and ubuntu images on Docker Hub, and every image built on them, ship the vulnerable APT and run it during docker build. An image you pull today is affected until its maintainers rebuild it; a Dockerfile that runs apt-get installs through the vulnerable APT unless it upgrades APT first.
• CI runners and build hosts that run apt-get install on every job, often on shared or cloud networks.

#How the vulnerability works

APT downloads a package, checks it against a hash from the signed archive index, and only then installs it. Installing runs the package's maintainer scripts as root, so the check is the whole defense: a package that fails it is never installed.

The flaw lets an attacker change a package after APT has checked it. When a download fails and APT retries it, APT reopened the file it was writing to without making sure that file was its own; it could be a hard link, a second name for the same file on disk, that another download also used. The CVE record says the vulnerability "is caused by the reuse of hard links and requires the client to follow redirects and retry the download of package files." The result is that APT installs a package other than the one it verified.

The attacker needs no login, only the ability to change APT's HTTP traffic: someone on the same network, a malicious mirror, or a proxy. Nothing happens until APT installs or upgrades a package, which unattended upgrades and container builds do on their own.

#The fix

Julian Andres Klode's fix makes APT's download methods open their target files exclusively, so a download can no longer write into a file that something else also points to. When APT resumes a download, it now copies what it already has into a fresh file instead of reopening the old one. The commit message: "Opening existing files and modifying them may modify files in unexpected ways if they are hardlinks. Ensure all files are opened exclusively." Fixed releases are tagged for every APT branch from 1.2 to 3.3.

The fix is dated October 12, three weeks before the coordinated release. It's the second man-in-the-middle route to root in APT from the same researcher: in 2019, Max Justicz reported CVE-2019-3462 (opens in a new tab), a flaw in how APT handled HTTP redirects.

#Which systems are exposed

What follows is our reading of the CVE record's requirements, not a confirmed exploit path for any one machine.

Release defaults aren't the whole story on older systems: scripts, configuration management, and CI templates commonly raise Acquire::Retries to ride out flaky mirrors. Check the setting, not just the release. Patch first the machines that install packages over networks you don't control: laptops, CI runners, and build hosts.

#How to check your systems

A host's APT and its containers' APT are separate copies, so check both. We tested these commands in the official Debian 11 through 13, Ubuntu 20.04 through 24.04, and Kali images on November 4.

#Check the APT version

dpkg-query -W -f='${Version}\n' apt

Compare the result with the distribution status above. On Ubuntu, the fixed versions end in ubuntu0.1; 2.8.3 or 2.4.14 means the fix hasn't reached that machine.

#Check the retry setting

apt-config dump | grep -i '^Acquire::Retries'

This prints only a value someone has set. No output means the release default applies: 3 from Debian 12 and Ubuntu 22.04, 0 before them. Kali prints Acquire::Retries "3"; from its own configuration.

#Check where packages come from

grep -rhoE '^(deb|URIs:) +[a-z]+://[^ ]+' /etc/apt/sources.list \  /etc/apt/sources.list.d/ 2>/dev/null | sort -u

http:// sources are open to anyone on the path. The default sources in every official image we checked were http://.

#Check images and running containers

docker run --rm --entrypoint dpkg-query your-image -W -f='${Version}\n' apt

An image without dpkg-query isn't Debian-based and fails to start, which answers the question too. Inside a running container, use docker exec with the same dpkg-query command.

#How to fix

#Update APT

sudo apt-get update && sudo apt-get install --only-upgrade aptdpkg-query -W -f='${Version}\n' apt

On Debian 12 and 13 this installs 2.6.2 and 3.0.4 today; we confirmed it in the official images. On Ubuntu 22.04 and later, it will install the ubuntu0.1 build once Ubuntu's archive serves it; until then the version won't change, so keep the interim setting below. Upgrading APT itself is enough: the bug is in how APT downloads, so nothing needs a reboot.

For containers, rebuild on a base image that has the fix, or add apt-get install --only-upgrade apt before any other apt-get install in the Dockerfile, so the rest of the build downloads through the fixed APT. Then rebuild every image, since one built before the fix keeps the old APT.

#If you can't patch immediately

These are Atlas' interim recommendations; they reduce exposure but don't fix APT.

Turn off download retries. The CVE record says the attack requires a non-zero Acquire::Retries:

echo 'Acquire::Retries "0";' | sudo tee /etc/apt/apt.conf.d/99-cve-2026-109518apt-config dump | grep -i '^Acquire::Retries'

The second command should print Acquire::Retries "0";. The cost is that a download that fails once now fails the whole run instead of being retried, so updates on flaky networks need rerunning. For a single command, pass -o Acquire::Retries=0. Remove the file once APT is fixed.

Install packages only over networks you trust, and use HTTPS sources where your mirror offers them. HTTPS keeps a network attacker out of the traffic, but not a mirror or proxy that serves it.

#End-of-life versions

Debian 11's long-term support ended on August 31, 2026. APT's developers tagged fixed builds for it and for older lines (2.2.5 for Debian 11, 1.8.2.4 for Debian 10, 1.4.12 for Debian 9) in the upstream repository, but no Debian update has shipped them: Freexian's extended-support tracker still lists Debian 9, 10, and 11 as vulnerable as of 12:50 PM CST, November 4. These releases have retries off by default, so they're exposed only if something turned retries on; check the setting, and plan the upgrade.

Ubuntu 20.04 and older get fixes through Ubuntu Pro's Expanded Security Maintenance: the CVE record lists fixed builds for 14.04 (1.0.1ubuntu2.24+esm4), 16.04 (1.2.36+esm1), 18.04 (1.6.19+esm1), and 20.04 (2.0.12+esm1). Without Pro, these releases get no fix.

#Timeline

#Other vulnerabilities fixed in this release

Debian's 3.0.4 and 2.6.2 also fix five out-of-bounds accesses, none with a CVE ID, and stop a memory blow-up during downloads. Titles are from APT's changelog:

• "deb: guard against unsigned underflow when trimming control newlines"
• "gpgv: don't advance past the null terminator in PushEntryWithKeyID"
• "debDebFileParser: reject .deb without a Version field"
• "srvrec: reject res_query answers bigger than our buffer"
• "tagfile: fix unbounded backward scan in Fill()'s trailing-newline check"
• "Memory exhaustion during download" (Debian bug #1111554)

#Updates to this post

We'll revise this post and mark it updated when any of these change: Ubuntu's archive serving the fixed APT, or Ubuntu publishing its notice; a fix reaching Debian testing, Kali, or Debian 11 through extended support; NVD's analysis; or a report of exploitation or public exploit code.

#Get help

APT talks to the internet from inside your network, so it helps to know what else does. Our free security audit checks the domains and public IPs you verify for exposed services, publicly visible software versions with known CVEs, TLS, email security, DNS, and HTTP headers.

#Sources