Operating system, libraries and runtimes

APT: CVE-2026-109518 a package download swapped after verification

APT check

APT is the package manager of Debian, Ubuntu and the distributions built on them. When an HTTP redirect gives two package downloads the same address, APT can merge them, and when it retries a download it reuses a file through a hard link. Someone who can alter the HTTP traffic between a host and its archive (an attacker on the network path, a malicious mirror or a proxy) can use redirects and ordinary temporary server errors to make APT retry, and replace a package after APT has verified it. The replaced package is installed as root (CVE-2026-109518).

No workaround is published by Debian, Ubuntu or the APT developers. Setting Acquire::Retries to 0 is the stopgap that follows from the description of the flaw: APT then does not retry a failed download, which can make updates less reliable on a poor connection. It is not the fix.

Fixed releases

The ranges are those of the CVE record. A version below 1.2.36 is affected, and so is any version in a line below the fixed release of that line. APT 1.8.3 through 1.8.5 are affected and the 1.8 line has no later fix. A development version between these lines (2.5, 2.7, 3.1) is not covered; the script says so and exits 2.

Ubuntu rates it high priority. A distribution built on Debian or Ubuntu has APT from its parent, so it is affected too; the script judges the installed APT version, whatever the distribution is called.

Quick start

1. Download the script. The repository is mirrored on GitHub and Codeberg; pick a base URL.

   # BASE from GitHub:   https://raw.githubusercontent.com/PrivacySafe/security-patches/refs/heads/main
   # BASE from Codeberg: https://codeberg.org/PrivacySafe/security-patches/raw/branch/main
   # curl -fLO "$BASE/apt/apt-nov2026-check.sh"
   curl -fLO https://raw.githubusercontent.com/PrivacySafe/security-patches/refs/heads/main/apt/apt-nov2026-check.sh
   

2. Read it before running it, then make it executable.

   less apt-nov2026-check.sh
   chmod +x apt-nov2026-check.sh
   

3. Check this host. It changes nothing and needs no root.

   ./apt-nov2026-check.sh check
   

4. Update APT, with retries off for the update itself, so the update is not exposed to the flaw it fixes.

   sudo apt-get -o Acquire::Retries=0 update
   sudo apt-get -o Acquire::Retries=0 install --only-upgrade apt
   

5. If the update is not published for your release yet, or cannot be installed yet, apply the stopgap and remove it after the update.

   sudo ./apt-nov2026-check.sh mitigate --dry-run
   sudo ./apt-nov2026-check.sh mitigate
   sudo ./apt-nov2026-check.sh rollback
   

Commands

Environment: STATE_DIR (default /var/lib/psf-security-patches/apt) holds the manifest. APT_CONF_DIR (default /etc/apt/apt.conf.d) is where mitigate writes. ARCHIVES_DIR and LISTS_DIR replace APT's package and list folders for hunt. APT_HELPER (default /usr/lib/apt/apt-helper) reads compressed index files. OS_RELEASE (default /etc/os-release) names the release. PSF_LOCK_WAIT is the number of seconds a run that changes the host waits for another one that is already changing it (default 30).

Commands that change the host need root. Run them with sudo from an admin account, not from a root login, so the change is recorded against a person. The script stops and prints the exact command if you forget.

How the check decides

• The version is compared with dpkg --compare-versions against the fixed release of its line. Ubuntu fixes some lines with a build below the upstream fix (3.3.3ubuntu0.1 for the 3.3 line), and the script accepts exactly those. An epoch is ignored.
• Retries are the explicit Acquire::Retries that apt-config reports, which merges /etc/apt/apt.conf.d and /etc/apt/apt.conf. When none is set, the default of the installed APT applies: 3 from APT 2.4 on, 0 before. A -o Acquire::Retries=... on a command line, and a script that sets it, are not visible to the check.
• Redirects are on unless Acquire::http::AllowRedirect and Acquire::https::AllowRedirect are both turned off. Turning redirects off also removes a condition, but it breaks mirrors that answer with a redirect, so mitigate does not do it.
• Sources are read from apt-get indextargets. A source over http can be altered by anyone on the network path. An https source is out of reach of an ordinary on-path attacker, but a malicious mirror, or a proxy that inspects TLS, is in scope in the advisories.

How to read the result

• Fixed: nothing to do. The retry and redirect lines are shown for information.
• Vulnerable, both conditions on: exit 1. Update APT. If the update is not out for your release, run mitigate.
• Vulnerable, one condition off: a warning, exit 0. The flaw is in the installed version, and a script, an image or a command line can turn retries back on, so update anyway.
• Cannot be judged: a development version of APT that falls between the published ranges. Move to a release line that lists a fix.
• After mitigate: check shows retries at 0 and a warning, never a clean pass, because the flaw is still in the installed version.

hunt is limited by what is published. No indicator of exploitation is named by any advisory, so a clean hunt means only that the two things it can see are in order. Many systems remove cached packages after an install; the hunt says so when there are none to compare. A cached package that the index no longer lists cannot be compared, and is reported as such, not as a lead. If a package was installed over plain http on a host that you cannot trust the network of, reinstall it from a trusted source.

Sources

• Debian security advisory DSA-6607-1 (trixie, 3.0.4)
• Debian security tracker, CVE-2026-109518 (trixie 3.0.4, bookworm 2.6.2 with DLA-4880-1, unstable 3.3.6, testing 3.3.5 vulnerable)
• Debian LTS announcement for bookworm
• Ubuntu CVE page and USN-8996-1
• The APT developers' announcement

Before you run it

• Updating APT is the fix. mitigate is a stopgap that removes one of the two conditions, and it makes a failed download fail instead of being retried.
• check reports the APT on this host. A container image, a chroot or a build host has its own APT, and so does anything that bakes -o Acquire::Retries=... into a command. Check those where they run.
• No workaround is published by the vendors. The advisories describe the attack over HTTP and do not say whether HTTPS sources are exposed.
• No attack in the wild is described in the advisories.

The Security Patches software and this documentation are dedicated to the public domain under CC0 1.0 Universal. Other pages on privacysafe.app/docs are CC BY-SA 4.0 unless the page says otherwise.

Edit this page on Codeberg