Debian and Ubuntu APT Flaw (CVE-2026-109518) Lets MitM Attackers Swap Verified Packages and Run Code as Root

Key facts for Debian APT retry flaw

Detection coverage for Debian APT retry flaw

As of 2026-11-04, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5253 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: CVE-2026-109518 APT Redirect Followed by Server Error or Resume on .deb Download (Exploitation)

Detects the network trigger of CVE-2026-109518 (APT-2026-11-01 / DSA-6607-1): an APT client downloading a .deb over plain HTTP that receives an HTTP 3xx redirect and then a transient 5xx error or a 206 range-resume for the same package URI within ten minutes. This redirect-plus-retry sequence is the condition abused by an on-path attacker to merge two downloads and swap a verified package after verification.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1195.002, T1557, T1553
• Data sources: splunk_stream_http, web_proxy_logs
• Severity: high
• Confidence: medium

Splunk SPL

index=proxy sourcetype="stream:http" http_user_agent="*APT-HTTP*" uri_path="*.deb"
| eval status_class=case(status>=300 AND status<400,"redirect", status>=500 AND status<600,"server_error", status=206,"resume", status=200,"ok", true(),"other")
| bin _time span=10m
| stats count(eval(status_class="redirect")) AS redirects count(eval(status_class="server_error")) AS server_errors count(eval(status_class="resume")) AS resumes count(eval(status_class="ok")) AS ok_responses dc(dest) AS dest_hosts values(site) AS sites BY _time src_ip uri_path
| where redirects>=1 AND (server_errors>=1 OR resumes>=1)
| table _time src_ip uri_path sites dest_hosts redirects server_errors resumes ok_responses

Microsoft KQL

CommonSecurityLog
| where TimeGenerated > ago(24h)
| where RequestClientApplication has "APT-HTTP" and RequestURL endswith ".deb"
| extend HttpStatus = toint(extract(@"(?:outcome|statusCode|cs1)=(\d{3})", 1, AdditionalExtensions))
| summarize Redirects = countif(HttpStatus between (300 .. 399)), ServerErrors = countif(HttpStatus between (500 .. 599)), Resumes = countif(HttpStatus == 206), OkResponses = countif(HttpStatus == 200), DestHosts = dcount(DestinationHostName) by bin(TimeGenerated, 10m), SourceIP, RequestURL
| where Redirects >= 1 and (ServerErrors >= 1 or Resumes >= 1)
| project TimeGenerated, SourceIP, RequestURL, DestHosts, Redirects, ServerErrors, Resumes, OkResponses

Sigma

title: CVE-2026-109518 APT Package Download Retry Indicators (HTTP 206 or 5xx on .deb)
id: 6b1f3c52-8a47-4d0e-9c1b-5e2a7d4f8a01
status: experimental
description: Detects APT-HTTP clients receiving a 206 range-resume or transient 5xx response while fetching a .deb, the retry path abused in CVE-2026-109518. Correlate with a preceding 3xx redirect for the same URI.
references:
    - https://lists.debian.org/debian-security-announce/2026/msg00526.html
    - https://ubuntu.com/security/CVE-2026-109518
    - https://lists.debian.org/deity/2026/11/msg00005.html
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-04
tags:
    - attack.initial-access
    - attack.t1195.002
    - attack.credential-access
    - attack.collection
    - attack.t1557
    - attack.defense-evasion
    - attack.t1553
    - cve.2026-109518
logsource:
    category: proxy
detection:
    selection:
        c-useragent|contains: 'APT-HTTP'
        c-uri|endswith: '.deb'
        sc-status:
            - 206
            - 500
            - 502
            - 503
            - 504
    condition: selection
falsepositives:
    - Flaky or overloaded package mirrors returning transient 5xx
    - Interrupted downloads legitimately resumed by APT
level: medium

Known false positives:

• Overloaded or flaky Debian/Ubuntu mirrors issuing a CDN redirect and a transient 503 for the same package
• Interrupted downloads on unstable links that APT legitimately resumes with a 206

Tuning notes: Set the index/sourcetype to your proxy or Stream HTTP data and map the status and user-agent field names. Exclude trusted internal mirror hosts via the site field, raise the redirect/retry thresholds for noisy mirrors, and prioritise hosts that fetch over plain HTTP (port 80) rather than HTTPS.

• 🔒 CVE-2026-109518 Non-APT Process Writing .deb Files in the [indicator] Archive Cache (Exploitation) · unlock with TL Creds
• 🔒 CVE-2026-109518 dpkg Installing a Package From [indicator] Partial Staging or World-Writable Paths (Post-Exploitation) · unlock with TL Creds
• 🔒 CVE-2026-109518 [indicator] Acquire Method Contacting Many Distinct Hosts or Ports (Redirect Abuse AiTM) · unlock with TL Creds
• 🔒 CVE-2026-109518 [indicator] Invoked With Retry or Verification-Weakening Options (Exploitation Exposure) · unlock with TL Creds
• 🔒 CVE-2026-109518 dpkg Maintainer Script Establishing Persistence or Privilege Backdoors (Post-Exploitation) · unlock with TL Creds
• 🔒 CVE-2026-109518 [indicator] HTTP Method Connecting to Non-Standard Ports (AiTM Proxy or Redirect Target) · unlock with TL Creds
• 🔒 CVE-2026-109518 dpkg Maintainer Script Spawning Download or Reverse-Shell Tooling (Post-Exploitation) · unlock with TL Creds
• 🔒 CVE-2026-109518 dpkg or dpkg-deb Initiating Outbound Network Connections (C2 After Package Swap) · unlock with TL Creds

Indicators of compromise for Debian APT retry flaw

As of 2026-11-04, Threadlinqs Intelligence tracks 16 indicators of compromise for TL-2026-5253.

How Debian APT retry flaw works

Reported by Max Justicz; fixes were released for Debian and Ubuntu on 2026-11-04.

CVE-2026-109518 is a flaw in the APT package manager used by Debian, Ubuntu and derivatives. Per the Debian security announcement (DSA-6607-1), APT can merge two different package downloads after an HTTP redirect gives them the same URI, and improper file handling when resuming an HTTP download allows a man-in-the-middle attacker to replace a package after verification, resulting in execution of arbitrary code as root. Ubuntu's CVE record attributes the issue to hardlink reuse and describes the impact as an on-path attacker who can manipulate HTTP traffic between an APT client and archive server tricking the client into installing an attacker-controlled unverified package.

Exploitation depends on APT's retry behavior. The APT developers' advisory (APT-2026-11-01, announced by Julian Andres Klode) explains that a remote attacker could bypass verification of downloaded packages using redirects and ordinary transient HTTP server errors that cause APT to retry downloads, potentially causing existing hardlinks to be overridden with a malicious payload. Because .deb files are installed with root privileges (including maintainer scripts), the APT developers classify the flaw as critical. The Acquire::Retries option became non-zero by default in APT 2.3.2, so Debian 12 and later and Ubuntu 22.04 LTS and later are vulnerable in default configuration (default value 3); Debian 11 and Ubuntu 20.04 and older are exposed only if Acquire::Retries is manually set to a non-zero value. The documented attack is over plain HTTP; HTTPS exposure was not clearly described in the sources.

The NVD/Ubuntu CVSS v4.0 vector is AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H (7.7 High), reflecting the attack-requirements and user-interaction prerequisites of the on-path position and an apt install/upgrade being triggered. Ubuntu rates priority High. The same update also fixes several out-of-bounds memory access bugs with limited direct security impact but potential denial-of-service risk in privileged daemon scenarios. Fixed versions per sources: Debian 12 (bookworm, DLA-4880-1) apt 2.6.2; Debian 13 (trixie, DSA-6607-1) apt 3.0.4; Debian 11 apt 2.2.5; Ubuntu 22.04 LTS 2.4.15ubuntu0.1, 24.04 LTS 2.8.4ubuntu0.1, 26.04 LTS 3.2.1ubuntu0.1, 26.10 3.3.3ubuntu0.1. Debian testing at apt 3.3.5 was still vulnerable as of 2026-11-04 14:58 UTC. Note: at fetch time the Ubuntu CVE page still listed all releases (including EOL 14.04-18.04) as Vulnerable with no fixed versions, conflicting with the fixed versions reported by The Hacker News; the fixed-version list above is as reported by the press article and Debian advisories. No public PoC or in-the-wild exploitation was reported in the sources.

MITRE ATT&CK techniques by tactic:

Execution

T1059.004 Unix Shell

Initial Access

T1195.002 Compromise Software Supply Chain

defense-impairment

T1553 Subvert Trust Controls

Credential Access

T1557 Adversary-in-the-Middle

Collection

T1557 Adversary-in-the-Middle

Impact

T1565.002 Data Manipulation

Remediation for Debian APT retry flaw

Patches

• Debian DSA-6607-1 (trixie): apt 3.0.4
• Debian DLA-4880-1 (bookworm): apt 2.6.2
• Debian 11: apt 2.2.5
• Ubuntu 22.04 LTS: apt 2.4.15ubuntu0.1
• Ubuntu 24.04 LTS: apt 2.8.4ubuntu0.1
• Ubuntu 26.04 LTS: apt 3.2.1ubuntu0.1
• Ubuntu 26.10: apt 3.3.3ubuntu0.1

Immediate actions

• Upgrade the apt package on all Debian/Ubuntu hosts to the fixed version for the release (e.g. Debian 12 apt 2.6.2, Debian 13 apt 3.0.4, Ubuntu 24.04 apt 2.8.4ubuntu0.1)
• Prioritize patching hosts that run apt over untrusted networks or via plain-HTTP mirrors and proxies
• Review apt update/upgrade activity and /var/log/apt and /var/log/dpkg.log for unexpected package installs since exposure

Workarounds

• On Debian 11 / Ubuntu 20.04 and older, avoid explicitly configuring a non-zero Acquire::Retries
• On releases where retries are the default, no vendor workaround was documented; apply the patch

Longer-term hardening

• Use HTTPS mirrors and trusted internal mirrors for APT sources and avoid untrusted proxies
• Monitor for unexpected apt/dpkg child processes and package hash mismatches against repository metadata
• Track Debian testing, which remained vulnerable at apt 3.3.5 on 2026-11-04

Affected and fixed versions

• Debian — apt
  Vulnerable versions: Debian 12 and later (default Acquire::Retries); Debian 11 with Acquire::Retries enabled; Debian testing apt 3.3.5
  Fixed in: Debian 11 apt 2.2.5; Debian 12 apt 2.6.2; Debian 13 apt 3.0.4
• Canonical — apt (Ubuntu)
  Vulnerable versions: Ubuntu 22.04 LTS and later (default); Ubuntu 20.04 LTS and older with Acquire::Retries enabled
  Fixed in: 22.04 LTS 2.4.15ubuntu0.1; 24.04 LTS 2.8.4ubuntu0.1; 26.04 LTS 3.2.1ubuntu0.1; 26.10 3.3.3ubuntu0.1

Timeline of Debian APT retry flaw

Last updated 2026-11-04 · revalidated 1× · latest source

• 2019-01-22 Earlier locked-ioc-16 redirect-handling RCE (CVE-2019-3462) by the same researcher, Max Justicz, publicly disclosed; same flaw class.
• 2026-11-04 Upstream fix released in locked-ioc-15 (sid); patches for stable branches 1.2.36 through 3.2.1 announced on the Debian deity list. locked-ioc-15 also adds exclusive file opening to prevent concurrent download collisions.
• 2026-11-04 The Hacker News reports the flaw; no public PoC or in-the-wild exploitation noted
• 2026-11-04 Debian testing (locked-ioc-9) reported still vulnerable as of 14:58 UTC
• 2026-11-04 Ubuntu CVE page published with High priority and CVSS 4.0 score 7.7; at fetch time it still listed all releases as vulnerable
• 2026-11-04 Ubuntu publishes fixed locked-ioc-16 packages for 22.04, 24.04, 26.04 LTS and 26.10 (reported 14:25 UTC)
• 2026-11-04 Debian publishes DSA-6607-1 (trixie, locked-ioc-11) and DLA-4880-1 (bookworm, locked-ioc-10) for CVE-2026-109518
• 2026-11-04 locked-ioc-16 developers announce APT-2026-11-01 (Julian Andres Klode) crediting Max Justicz for reporting CVE-2026-109518

Update history

• 2026-11-04 — CVE-2026-109518: Debian/Ubuntu locked-ioc-16 HTTP Redirect Flaw Enables Package Hijack and Root Code Execution: What changed No severity, exploitability or status change; still HIGH / NONE / PATCHED with no reported exploitation or public PoC. New indicators (6) Indicator values are withheld at this access level. New MITRE (1) Added T1565.002 Transmi

Sources cited for Debian APT retry flaw

• Debian Security Advisory DSA-6607-1 (apt) lists.debian.org · Advisory · 2026-11-04
• APT developers announcement APT-2026-11-01 lists.debian.org · Advisory · 2026-11-04
• NVD: CVE-2026-109518 NVD (NIST) · Advisory · 2026-11-04
• Debian LTS Advisory DLA-4880-1 (apt, bookworm) lists.debian.org · Advisory · 2026-11-04
• Ubuntu Security: CVE-2026-109518 ubuntu.com · Vendor report · 2026-11-04
• The Hacker News: Debian and Ubuntu APT Flaw Lets MitM Attackers Swap Verified Packages and Run Code as Root The Hacker News · News · 2026-11-04

More in vulnerability

• Zyxel GS1900 Switch Zero-Day (CVE-2026-107441) Exploited by Kapibala in Red Heron Campaign, ~1,000 Switches Compromised
• Critical Ruby on Rails Active Storage Flaw (GHSA-f3w6-w445-fwh9) Allows Server Secret Theft via Malicious Image Uploads to ImageMagick (CVE not yet assigned)
• Increased Scanning for Vulnerable Legacy E-Mail Test Scripts (formail/mailtest.php variants, CVE-2000-0411 lineage)
• Critical Rails Active Storage Flaw (GHSA-f3w6-w445-fwh9) Lets Attackers Write Server Files via Crafted ImageMagick Uploads
• Google Chrome 157 Security Update Fixes 213 Bugs Including 7 Critical Vulnerabilities (CVE-2026-121156, CVE-2026-121247, CVE-2026-121229, CVE-2026-121246, CVE-2026-121035, CVE-2026-121203, CVE-2026-121126)