L3 · ShartedAPT · Debian · Ubuntuapt-download-verification

APT can install an unverified package as root after HTTP redirects and retries

CVE-2026-109518 lets an on-path attacker replace an APT package after verification through HTTP redirects, retries and hard-link reuse. Non-zero Acquire::Retries is required. Debian and Ubuntu now list fixed packages; Canonical documents a zero-retry upgrade path. No exploitation is established.

Disclosed: Nov 4, 2026; Updated Nov 4, 2026
Severity: CVSS 7.7; 1 CVE tracked here
Splash zone: APT clients using attacker-manipulable HTTP downloads, redirects/retries and non-zero Acquire::Retries.; APT · Debian · Ubuntu
In the wild: Unknown; CISA’s November 4 assessment records no exploitation; no actual victims verified.

What happened

APT’s hard-link reuse during download redirects and retries lets a network-path attacker cause installation of an attacker-controlled, unverified package. A malicious mirror or proxy is within the stated threat model; this is not a claim that package signing keys or the Debian archive were compromised.

The attack needs an install/download with redirects, retries and a non-zero retry setting. Debian and Ubuntu defaults make newer releases exposed, but older releases can also be exposed under changed configuration. Canonical rates the flaw high; no actual exploitation or victim count is established.

Debian’s tracker supplies the three distribution fixes listed above. At our earlier check, Ubuntu still marked releases vulnerable and USN-8996-1 returned 404. November 4 availability update: the USN is now readable and the CVE page lists the eight Ubuntu fixes above. For 26.10, blog responses during these checks differed between publishing and fixed, while USN/CVE list 3.3.3ubuntu0.1 fixed. Verify the actual repository candidate and installed version; do not assume rollout has reached every mirror. Older releases require the indicated Pro/ESM and Legacy coverage.

Canonical recommends disabling retries for the upgrade itself, including when defending against a malicious mirror. HTTPS to a trusted mirror protects against network-path manipulation; patching remains required. Snap installation uses a different system and is outside this APT flaw. The Debian mailing-list access challenge remains unresolved; no unread mailing-list content is used as evidence.

What’s in the bowl

CVE-2026-109518CVSS 7.7

APT download verification bypass

Hard-link reuse permits substitution after verification during HTTP redirect/retry handling; Canonical assigns CVSS 4.0 7.7.

Fixed versions

Product	Safe from	Note
Debian 13 trixie APT	`3.0.4`	Debian security tracker: fixed
Debian 12 bookworm APT	`2.6.2`	Debian security tracker: fixed
Debian unstable APT	`3.3.6`	Debian tracker: fixed; forky still lists 3.3.5 vulnerable
Ubuntu 26.10 APT	`3.3.3ubuntu0.1`	USN/CVE list fixed; blog responses vary between publishing and fixed. Verify the actual repository candidate.
Ubuntu 26.04 LTS APT	`3.2.1ubuntu0.1`	Standard security support
Ubuntu 24.04 LTS APT	`2.8.4ubuntu0.1`	Standard security support
Ubuntu 22.04 LTS APT	`2.4.15ubuntu0.1`	Standard security support
Ubuntu 20.04 LTS APT	`2.0.12+esm1`	Ubuntu Pro / ESM
Ubuntu 18.04 LTS APT	`1.6.19+esm1`	Ubuntu Pro / ESM
Ubuntu 16.04 LTS APT	`1.2.36+esm1`	Ubuntu Pro / ESM with Legacy add-on
Ubuntu 14.04 LTS APT	`1.0.1ubuntu2.24+esm4`	Ubuntu Pro / ESM with Legacy add-on

Crime-scene timeline

Nov 4, 2026
Debian and Canonical publish APT vulnerability and remediation records
Debian lists fixed bookworm/trixie/unstable packages. Canonical describes the HTTP redirect/retry prerequisite; its public CVE page and CNA version records differ on release availability.
Nov 4, 2026
Canonical publishes USN and updates Ubuntu availability
USN-8996-1 and the CVE page list eight fixed builds. The blog supplies Acquire::Retries=0 upgrade commands; responses during checks differ between publishing and fixed for 26.10, so verify the actual repository candidate.

Who said what

We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.

Debian security trackerPrimaryLists bookworm 2.6.2, trixie 3.0.4 and unstable 3.3.6 fixed; forky 3.3.5 vulnerable.
Canonical CVE pagePrimaryCVE page now lists fixed Ubuntu 14.04–26.10 builds and required Pro/Legacy coverage; supersedes the earlier vulnerable statuses.
Canonical CNA original recordPrimaryAffected/fixed thresholds and CVSS 4.0; CISA November 4 assessment records no exploitation. The previously unavailable USN is now readable.
Canonical USN-8996-1PrimaryNovember 4 release notice lists eight Ubuntu fixed packages, including ESM/Legacy requirements.
Canonical APT remediation explanationPrimaryZero-retry upgrade commands, HTTPS mitigation and installed-source-package check; observed 26.10 responses differ between publishing and fixed, with the same 3.3.3ubuntu0.1 threshold.

Wipe guide

The wipe checklist

0 of 4 sheets used

Inventory APT and install the distribution fixCheck apt --version and apt-cache policy apt on hosts, base images and CI runners. Debian 13 needs 3.0.4, Debian 12 needs 2.6.2; unstable lists 3.3.6. Use a trusted administrative network/repository route to update apt and its matching packages. Keep distribution suffixes and vendor backports; do not install Debian packages on Ubuntu or infer that an upstream version proves a distribution build is fixed.
Check HTTP sources, proxies and retry configurationReview /etc/apt/sources.list, /etc/apt/sources.list.d/ and apt-config dump for HTTP repository URLs, proxies and Acquire::Retries. A non-zero value is required; 3 is the default starting with Debian 12 and Ubuntu 22.04. Older defaults do not imply safety if administrators enabled retries. Reduce exposure to untrusted network paths and use verified HTTPS repository/proxy endpoints where supported; never disable signature or TLS checks. Canonical now explicitly confirms that setting Acquire::Retries=0 prevents this retry path, including a malicious mirror; trusted HTTPS transport protects against an on-path attacker. HTTPS alone does not establish trust in a malicious mirror.
Use Canonical’s zero-retry Ubuntu upgrade pathCanonical recommends sudo apt update && sudo apt upgrade -o Acquire::Retries=0. To target the APT source package instead: sudo apt update && sudo apt install -o Acquire::Retries=0 --only-upgrade '?source-package(^apt$)'. Check all installed APT-source packages with apt list --installed '?source-package(^apt$)' and compare their full distribution versions with USN-8996-1. Ubuntu 20.04/18.04 need Pro/ESM; 16.04/14.04 also need the Legacy add-on. For 26.10, verify that 3.3.3ubuntu0.1 is actually offered: USN/CVE list fixed, while blog responses during checks differ between publishing and fixed. Use a trusted HTTPS mirror before patching where supported; do not disable verification.
Investigate suspicious package installationsPreserve APT/dpkg history, proxy/repository logs and package files around suspicious redirects or retries. Affected installs can execute package scripts as root; compare package provenance through trusted vendor records and investigate host persistence. No dedicated attack IoCs or victim total were verified; an unusual redirect alone does not prove compromise.