Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilityhigh

Debian and Ubuntu patch APT flaw enabling root package swap

3 sources · 3 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Debian and Ubuntu patched CVE-2026-109518, an APT flaw that can let an on-path attacker replace packages and gain root.

Max Justicz found that APT can merge package downloads sharing a URI after an HTTP redirect and mishandle resumed downloads, letting a man-in-the-middle replace a package. GBHackers and CSO Online say that can install attacker-controlled packages with root privileges. Exploitation requires control of HTTP traffic and non-zero retry settings. GBHackers reports no active exploitation and says older releases with retries at zero are not exploitable by default; CSO Online says non-zero retries are the default. Fixes include APT 3.0.4; GBHackers cites that for Debian Trixie and Ubuntu 2.4.15ubuntu0.1 for 22.04 LTS, while CSO Online also lists APT 2.6.2 and Debian 12 Bookworm.

Key facts
  • CVE-2026-109518 is covered by Debian advisory DSA 6607-1.
  • Attack needs HTTP traffic control and non-zero APT retry settings.
  • GBHackers rates it CVSS v4.0 7.7 and reports no active exploitation.
  • CSO Online says the flaw overrides hard links after URI merges.
  • Named fixes include APT 3.0.4, APT 2.6.2, and Ubuntu 2.4.15ubuntu0.1.
Analyze CVE-2026-109518 with Vani AIImpact, affected versions, exploitation, mitigations and detection

What each outlet adds

beyond the shared facts
  • oss-securityNames DSA 6607-1 and the redirect-merge resume flaw.
  • GBHackersCVSS 7.7, Trixie APT 3.0.4, Ubuntu package, no exploitation.
  • CSO OnlineBookworm affected; APT 2.6.2; hard links; retries default on.
CVEs
CVE-2026-109518
Vendors
DebianCanonicaldebianubuntu
Products
APTapt
Countries
Germany

Coverage

oldest first · one row per article · UTC
  1. · 6d ago oss-securityFirst report

    CVE-2026-109518: RCE in Debian apt package manager

    Debian advisory reveals man-in-the-middle vulnerability in APT allowing package replacement.

  2. · 6d ago GBHackers

    Debian and Ubuntu APT Vulnerability Allows Root Code Execution (CVE-2026-109518)

    CVE-2026-109518 in APT lets on-path attackers install malicious packages with root privileges via HTTP redirects and retry mishandling.

  3. · 6d ago CSO Online

    Debian Ubuntu patch APT flaw allowing root via redirects

    CVE-2026-109518 in APT lets MITM attackers install packages with root privileges using HTTP redirects and retries.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-109518
Man-in-the-middle RCE in APT on Debian and Ubuntu
7.7<1%PoC ×2