L3 · ShartedAPT · Debian · Ubuntuapt-download-verification

APT can install an unverified package as root after HTTP redirects and retries

CVE-2026-109518 lets an on-path attacker replace an APT package after verification through HTTP redirects, download retries and hard-link reuse. Non-zero Acquire::Retries is required. Debian fixes are available; Ubuntu’s CVE page still lists releases vulnerable. No exploitation is established.

Disclosed: Nov 4, 2026; Public disclosure date
Severity: CVSS 7.7; 1 CVE tracked here
Splash zone: APT clients using attacker-manipulable HTTP downloads, redirects/retries and non-zero Acquire::Retries.; APT · Debian · Ubuntu
In the wild: Unknown; CISA’s November 4 assessment records no exploitation; no actual victims verified.

What happened

APT’s hard-link reuse during download redirects and retries lets a network-path attacker cause installation of an attacker-controlled, unverified package. A malicious mirror or proxy is within the stated threat model; this is not a claim that package signing keys or the Debian archive were compromised.

The attack needs an install/download with redirects, retries and a non-zero retry setting. Debian and Ubuntu defaults make newer releases exposed, but older releases can also be exposed under changed configuration. Canonical rates the flaw high; no actual exploitation or victim count is established.

Debian’s tracker supplies the three distribution fixes listed above. Canonical’s CNA additionally describes older Debian and Ubuntu version thresholds; those are not proof that a supported distribution update is available. Its current Ubuntu page still lists affected releases, and the linked USN returned 404. Debian mailing-list originals presented an access challenge; no challenge was bypassed, and no unread mailing-list text is used as evidence.

What’s in the bowl

CVE-2026-109518CVSS 7.7

APT download verification bypass

Hard-link reuse permits substitution after verification during HTTP redirect/retry handling; Canonical assigns CVSS 4.0 7.7.

Fixed versions

Product	Safe from	Note
Debian 13 trixie APT	`3.0.4`	Debian security tracker: fixed
Debian 12 bookworm APT	`2.6.2`	Debian security tracker: fixed
Debian unstable APT	`3.3.6`	Debian tracker: fixed; forky still lists 3.3.5 vulnerable
Ubuntu APT	No fix	CVE page still lists 14.04–26.10 vulnerable; CNA names thresholds but linked USN is unavailable. Verify an actual release before relying on it.

Crime-scene timeline

Nov 4, 2026
Debian and Canonical publish APT vulnerability and remediation records
Debian lists fixed bookworm/trixie/unstable packages. Canonical describes the HTTP redirect/retry prerequisite; its public CVE page and CNA version records differ on release availability.

Who said what

We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.

Debian security trackerPrimaryLists bookworm 2.6.2, trixie 3.0.4 and unstable 3.3.6 fixed; forky 3.3.5 vulnerable.
Canonical CVE pagePrimaryExplains network-path, redirects, retries and configuration defaults; still lists Ubuntu releases vulnerable.
Canonical CNA original recordPrimaryDetailed affected/fixed version thresholds and CVSS 4.0; CISA November 4 assessment records no exploitation. Referenced Ubuntu USN returned 404.

Wipe guide

The wipe checklist

0 of 4 sheets used

Inventory APT and install the distribution fixCheck apt --version and apt-cache policy apt on hosts, base images and CI runners. Debian 13 needs 3.0.4, Debian 12 needs 2.6.2; unstable lists 3.3.6. Use a trusted administrative network/repository route to update apt and its matching packages. Keep distribution suffixes and vendor backports; do not install Debian packages on Ubuntu or infer that an upstream version proves a distribution build is fixed.
Check HTTP sources, proxies and retry configurationReview /etc/apt/sources.list, /etc/apt/sources.list.d/ and apt-config dump for HTTP repository URLs, proxies and Acquire::Retries. A non-zero value is required; 3 is the default starting with Debian 12 and Ubuntu 22.04. Older defaults do not imply safety if administrators enabled retries. Reduce exposure to untrusted network paths and use verified HTTPS repository/proxy endpoints where supported; never disable signature or TLS checks. This is exposure reduction, not a proven substitute for patching.
Resolve Ubuntu package availability through the vendorCanonical’s CNA names fixed thresholds, while its CVE page still marks releases vulnerable and USN-8996-1 returned 404. Follow the official Ubuntu CVE page and your release’s security notices/repository candidate; obtain support confirmation if needed. Do not treat a reserved version threshold as proof the update is distributed.
Investigate suspicious package installationsPreserve APT/dpkg history, proxy/repository logs and package files around suspicious redirects or retries. Affected installs can execute package scripts as root; compare package provenance through trusted vendor records and investigate host persistence. No dedicated attack IoCs or victim total were verified; an unusual redirect alone does not prove compromise.