Debian DSA-6607-1: apt CVE-2026-109518 lets a network attacker swap packages, fixed in apt 3.0.4

Debian published security advisory DSA-6607-1 on 4 November 2026 for APT, the package manager that installs software on Debian, Ubuntu and their derivatives. The flaw, CVE-2026-109518, lets someone who can tamper with your HTTP traffic swap a package after APT has verified it, and so run code as root. Fixed APT versions exist for Debian 12 and 13, while Ubuntu's tracker listed every supported release as still vulnerable when we checked.

Key points

• CVE-2026-109518 affects APT: after an HTTP redirect gives two downloads the same URI, APT can merge them, and a man-in-the-middle can replace a package after verification (Debian DSA-6607-1).
• The result is arbitrary code execution as root during a package install; Ubuntu rates the issue High priority.
• Fixed in APT 3.0.4 on Debian 13 "trixie" (DSA-6607-1), APT 2.6.2 on Debian 12 "bookworm" (DLA-4880-1) and 3.3.6 in unstable.
• Ubuntu's page for the CVE, dated 4 November 2026, listed APT as "Vulnerable" on every Ubuntu release from 14.04 LTS to 26.10, with no fixed version yet.
• Per Ubuntu, exploitation needs a non-zero Acquire::Retries setting; 3 is the default on Debian 12 and Ubuntu 22.04 LTS and newer.

What to do

Who is affected. Anyone running APT on Debian, Ubuntu or a derivative, where an attacker could sit between the machine and its package mirror: a hostile Wi-Fi network, a compromised proxy, a malicious or hijacked mirror. Ubuntu's description says older releases are unaffected "in a default configuration", because the retry setting is lower there.

Fixed versions we could confirm.

Distribution	Package version	Advisory
Debian 13 "trixie" (security)	apt 3.0.4	DSA-6607-1
Debian 12 "bookworm" (security)	apt 2.6.2	DLA-4880-1
Debian unstable (sid)	apt 3.3.6	Debian tracker

Debian's tracker still marks the base "forky" (testing) version 3.3.5 as vulnerable, and trixie 3.0.3 and bookworm 2.6.1 as vulnerable until the security versions are installed. Debian recommends upgrading the apt package, which is a normal apt update && apt upgrade on a Debian machine that already has the security repository configured.

Ubuntu. At the time of writing the tracker showed no fix. Watch the Ubuntu CVE page and apply the apt update the moment it appears.

Until then (our reading, not vendor guidance). Neither Debian nor Ubuntu names a workaround. Because Ubuntu's description says the attack needs the client to retry downloads, setting Acquire::Retries to 0 should remove that condition, and the usual advice for any network-level package attack applies too: do not run installs over untrusted networks, and prefer HTTPS mirrors you control. We have not tested the retry change, so treat it as a precaution and not a guaranteed fix.

Check your version. Run apt --version and compare with the table above, and apt-config dump | grep Retries to see your retry value.

What happened

The Debian security team's announcement, sent by Salvatore Bonaccorso on 4 November 2026 at 12:07 UTC, credits Max Justicz with finding the bug. The advisory describes it in one sentence: APT "can merge two different package downloads after an HTTP redirect gives them the same URI". It adds that improper file handling when resuming an HTTP download lets a man-in-the-middle attacker replace a package after verification, "resulting in the execution of arbitrary code as root".

The same announcement says the stable release, Debian 13 "trixie", is fixed in APT 3.0.4, and that the update also fixes several out-of-bounds access issues. Those are separate from the CVE and the advisory gives no identifiers for them.

Ubuntu's security page, published the same day, gives the mechanism in more detail. It says the problem is caused by "the reuse of hard links" and requires the client to follow redirects and retry the download of package files. An on-path attacker, including a malicious mirror or proxy, can then trick the client into installing an attacker-controlled package that was never verified. That makes it a flaw in file handling around the signature check, not in the signatures themselves: the checks work, but the file that gets installed is not the file that was checked.

Debian's security tracker links the CVE to two advisories: DSA-6607-1 for trixie and DLA-4880-1 for bookworm, the long-term-support release. It lists the fixed versions above and points to a message on the Debian "deity" development list (lists.debian.org/deity/2026/11/msg00005.html) as a note. We did not find a CVSS score from the National Vulnerability Database, whose page refused our request, so we do not quote one.

Background

APT has been here before. In January 2019 the same researcher, Max Justicz, disclosed CVE-2019-3462, another flaw in how APT handled HTTP redirects: the fetcher failed to sanitise the redirect field, which let a man-in-the-middle inject content and achieve code execution as root. That bug was fixed in APT 1.4.9, and the Debian advice at the time was to run apt -o Acquire::http::AllowRedirect=false while upgrading. Coverage of it at the time included SecurityWeek.

The 2019 and 2026 flaws are different bugs, but they share a lesson. APT signs repository metadata and checks package hashes, so the content of a download is hard to forge. Attackers therefore aim at the plumbing around those checks: redirects, retries, temporary files. Ubuntu's page notes that the 2026 condition depends on the retry setting, and that the default of 3 arrived with Debian 12 and Ubuntu 22.04 LTS, so the more recent a release is, the more likely it is to be exposed by default.

How it works

The sources describe the attack in outline, not as a step-by-step exploit, and we do not reconstruct one. In outline:

1. APT starts downloading a package and the server answers with an HTTP redirect.
2. The download is retried, which is allowed when Acquire::Retries is above zero.
3. Because the redirect gives two downloads the same URI, and because hard links are reused, APT can end up merging the two downloads (Debian) or sharing the file between them (Ubuntu's hard-link description).
4. An attacker who controls the traffic can use that confusion to put a different file in place after the original has passed verification, so the installer unpacks the attacker's package with root privileges.

Whether the attacker needs to be in a position to alter only the redirect or the whole connection is not spelled out in the advisories, and we have not seen the researcher's write-up, so we leave that open.

What it means

For individual users on a home connection with HTTPS mirrors, the practical risk is limited: the attacker has to be on the path between you and the mirror. The people who should move quickly are those who install packages on untrusted networks (public Wi-Fi, conference networks, hotel connections), those whose machines fetch packages through a shared HTTP proxy, and operators of build servers and container pipelines that run apt-get install against mirrors they do not control. Build pipelines deserve a look too, since an image built through a tampered proxy would carry whatever package was installed into it.

APT's design leans on signatures to make the transport irrelevant, and this flaw is a reminder that it is not entirely irrelevant. Using HTTPS sources where your mirror supports them makes an on-path position harder to get (our suggestion, not advice from the advisories), though it does not replace the update.

Debian users are ahead of Ubuntu users right now: Debian shipped fixes in both supported stable lines on the day of disclosure, including the LTS release. Ubuntu's page listed all releases as vulnerable, including the old 14.04 and 16.04 releases. Derivatives that track Ubuntu or Debian will likely inherit the fix when their base distribution does; we did not check any of them.

What we don't know yet

• Ubuntu's timeline. The tracker gives no fixed version or date.
• A severity score. Ubuntu says High priority; we found no published CVSS vector.
• Exploitation in the wild. None of the sources we read reports attacks. We would say so if one did.
• Exact conditions. Whether HTTPS mirrors fully block the attack depends on details the advisories do not give.
• Other derivatives and older Debian releases. Debian's tracker lists bookworm and trixie only; the status of releases that are no longer supported is not stated.

What to watch next

Watch for the Ubuntu fix across its supported releases, a published CVSS score, the researcher's write-up with the full mechanism, and any report of exploitation. If you manage servers, add the check apt --version to your fleet inventory today so that you can tell which hosts still need the update.

Sources

• Debian Security Advisory DSA-6607-1, apt security update (4 November 2026)
• Debian security tracker: CVE-2026-109518
• Debian security tracker: apt package versions
• Debian security tracker: DLA-4880-1
• Ubuntu security page for CVE-2026-109518
• SecurityWeek on the 2019 APT flaw, CVE-2019-3462