Debian Ubuntu patch APT flaw allowing root via redirects
Original title: Debian, Ubuntu patch APT flaw that could hand attackers root
CVE-2026-109518 in APT lets MITM attackers install packages with root privileges using HTTP redirects and retries.
APT mishandles HTTP redirects and resumed downloads by merging package URIs and overriding hard links. This allows an on-path attacker to replace verified packages with attacker-controlled ones. Debian and Ubuntu issued fixes; exploitation requires specific retry settings and is rated high.
- CVE-2026-109518 disclosed by Max Justicz
- Affects Debian 12 Bookworm and Ubuntu 22.04 LTS
- Fix in APT 3.0.4 and 2.6.2
- Requires non-zero retries which is default
Impact: arbitrary code execution as root
- 1.Update APT to 3.0.4 or 2.6.2
- 2.Disable retries if non-default
- 3.Use HTTPS for downloads
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-109518 | Man-in-the-middle RCE in APT on Debian and Ubuntu | 7.7 | <1% | PoC ×2 |
From the original article
2 min read at csoonline.com
Linux administrators’ trust in package managers is being tested by a newly disclosed vulnerability in APT, the package management system used by Debian, Ubuntu, and their derivatives, that could allow attackers to install unverified software with root privileges.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.