# Debian and Ubuntu APT Flaw (CVE-2026-109518) Lets MitM Attackers Swap Verified Packages and Run Code as Root

> An on-path attacker who can manipulate HTTP traffic between an APT client and an archive server can trick APT into installing an attacker-controlled, unverified package and execute code as root. The attack abuses APT's download retry logic, triggered by HTTP redirects and transient server errors. Reported by Max Justicz; fixes were released for Debian and Ubuntu on 2026-11-04.

- **Published:** 2026-11-04T17:41:35Z
- **Last reviewed:** 2026-11-04T18:28:11.857Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5253
- **ID:** TL-2026-5253
- **Severity:** HIGH (CVSS 7.7)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 16
- **CVEs:** CVE-2026-109518

## Description

CVE-2026-109518 is a flaw in the APT package manager used by Debian, Ubuntu and derivatives. Per the Debian security announcement (DSA-6607-1), APT can merge two different package downloads after an HTTP redirect gives them the same URI, and improper file handling when resuming an HTTP download allows a man-in-the-middle attacker to replace a package after verification, resulting in execution of arbitrary code as root. Ubuntu's CVE record attributes the issue to hardlink reuse and describes the impact as an on-path attacker who can manipulate HTTP traffic between an APT client and archive server tricking the client into installing an attacker-controlled unverified package.

Exploitation depends on APT's retry behavior. The APT developers' advisory (APT-2026-11-01, announced by Julian Andres Klode) explains that a remote attacker could bypass verification of downloaded packages using redirects and ordinary transient HTTP server errors that cause APT to retry downloads, potentially causing existing hardlinks to be overridden with a malicious payload. Because .deb files are installed with root privileges (including maintainer scripts), the APT developers classify the flaw as critical. The Acquire::Retries option became non-zero by default in APT 2.3.2, so Debian 12 and later and Ubuntu 22.04 LTS and later are vulnerable in default configuration (default value 3); Debian 11 and Ubuntu 20.04 and older are exposed only if Acquire::Retries is manually set to a non-zero value. The documented attack is over plain HTTP; HTTPS exposure was not clearly described in the sources.

The NVD/Ubuntu CVSS v4.0 vector is AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H (7.7 High), reflecting the attack-requirements and user-interaction prerequisites of the on-path position and an apt install/upgrade being triggered. Ubuntu rates priority High. The same update also fixes several out-of-bounds memory access bugs with limited direct security impact but potential denial-of-service risk in privileged daemon scenarios. Fixed versions per sources: Debian 12 (bookworm, DLA-4880-1) apt 2.6.2; Debian 13 (trixie, DSA-6607-1) apt 3.0.4; Debian 11 apt 2.2.5; Ubuntu 22.04 LTS 2.4.15ubuntu0.1, 24.04 LTS 2.8.4ubuntu0.1, 26.04 LTS 3.2.1ubuntu0.1, 26.10 3.3.3ubuntu0.1. Debian testing at apt 3.3.5 was still vulnerable as of 2026-11-04 14:58 UTC. Note: at fetch time the Ubuntu CVE page still listed all releases (including EOL 14.04-18.04) as Vulnerable with no fixed versions, conflicting with the fixed versions reported by The Hacker News; the fixed-version list above is as reported by the press article and Debian advisories. No public PoC or in-the-wild exploitation was reported in the sources.

## MITRE ATT&CK

- T1195.002 Compromise Software Supply Chain
- T1557 Adversary-in-the-Middle
- T1557 Adversary-in-the-Middle
- T1553 Subvert Trust Controls
- T1059.004 Unix Shell
- T1565.002 Data Manipulation

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**CVE-2026-109518 APT Redirect Followed by Server Error or Resume on .deb Download (Exploitation)** (`TL-2026-5253-SPL-001`)

Detects the network trigger of CVE-2026-109518 (APT-2026-11-01 / DSA-6607-1): an APT client downloading a .deb over plain HTTP that receives an HTTP 3xx redirect and then a transient 5xx error or a 206 range-resume for the same package URI within ten minutes. This redirect-plus-retry sequence is the condition abused by an on-path attacker to merge two downloads and swap a verified package after verification.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1195.002, T1557, T1553
- **Data sources:** splunk_stream_http, web_proxy_logs
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

```spl
index=proxy sourcetype="stream:http" http_user_agent="*APT-HTTP*" uri_path="*.deb"
| eval status_class=case(status>=300 AND status<400,"redirect", status>=500 AND status<600,"server_error", status=206,"resume", status=200,"ok", true(),"other")
| bin _time span=10m
| stats count(eval(status_class="redirect")) AS redirects count(eval(status_class="server_error")) AS server_errors count(eval(status_class="resume")) AS resumes count(eval(status_class="ok")) AS ok_responses dc(dest) AS dest_hosts values(site) AS sites BY _time src_ip uri_path
| where redirects>=1 AND (server_errors>=1 OR resumes>=1)
| table _time src_ip uri_path sites dest_hosts redirects server_errors resumes ok_responses
```

### Microsoft KQL

```kql
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where RequestClientApplication has "APT-HTTP" and RequestURL endswith ".deb"
| extend HttpStatus = toint(extract(@"(?:outcome|statusCode|cs1)=(\d{3})", 1, AdditionalExtensions))
| summarize Redirects = countif(HttpStatus between (300 .. 399)), ServerErrors = countif(HttpStatus between (500 .. 599)), Resumes = countif(HttpStatus == 206), OkResponses = countif(HttpStatus == 200), DestHosts = dcount(DestinationHostName) by bin(TimeGenerated, 10m), SourceIP, RequestURL
| where Redirects >= 1 and (ServerErrors >= 1 or Resumes >= 1)
| project TimeGenerated, SourceIP, RequestURL, DestHosts, Redirects, ServerErrors, Resumes, OkResponses
```

### Sigma

```yaml
title: CVE-2026-109518 APT Package Download Retry Indicators (HTTP 206 or 5xx on .deb)
id: 6b1f3c52-8a47-4d0e-9c1b-5e2a7d4f8a01
status: experimental
description: Detects APT-HTTP clients receiving a 206 range-resume or transient 5xx response while fetching a .deb, the retry path abused in CVE-2026-109518. Correlate with a preceding 3xx redirect for the same URI.
references:
    - https://lists.debian.org/debian-security-announce/2026/msg00526.html
    - https://ubuntu.com/security/CVE-2026-109518
    - https://lists.debian.org/deity/2026/11/msg00005.html
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-04
tags:
    - attack.initial-access
    - attack.t1195.002
    - attack.credential-access
    - attack.collection
    - attack.t1557
    - attack.defense-evasion
    - attack.t1553
    - cve.2026-109518
logsource:
    category: proxy
detection:
    selection:
        c-useragent|contains: 'APT-HTTP'
        c-uri|endswith: '.deb'
        sc-status:
            - 206
            - 500
            - 502
            - 503
            - 504
    condition: selection
falsepositives:
    - Flaky or overloaded package mirrors returning transient 5xx
    - Interrupted downloads legitimately resumed by APT
level: medium

```

**Known false positives:**

- Overloaded or flaky Debian/Ubuntu mirrors issuing a CDN redirect and a transient 503 for the same package
- Interrupted downloads on unstable links that APT legitimately resumes with a 206

**Tuning notes:** Set the index/sourcetype to your proxy or Stream HTTP data and map the status and user-agent field names. Exclude trusted internal mirror hosts via the site field, raise the redirect/retry thresholds for noisy mirrors, and prioritise hosts that fetch over plain HTTP (port 80) rather than HTTPS.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- CVE-2026-109518 Non-APT Process Writing .deb Files in the [indicator] Archive Cache (Exploitation) (locked: unlock with TL Creds)
- CVE-2026-109518 dpkg Installing a Package From [indicator] Partial Staging or World-Writable Paths (Post-Exploitation) (locked: unlock with TL Creds)
- CVE-2026-109518 [indicator] Acquire Method Contacting Many Distinct Hosts or Ports (Redirect Abuse AiTM) (locked: unlock with TL Creds)
- CVE-2026-109518 [indicator] Invoked With Retry or Verification-Weakening Options (Exploitation Exposure) (locked: unlock with TL Creds)
- CVE-2026-109518 dpkg Maintainer Script Establishing Persistence or Privilege Backdoors (Post-Exploitation) (locked: unlock with TL Creds)
- CVE-2026-109518 [indicator] HTTP Method Connecting to Non-Standard Ports (AiTM Proxy or Redirect Target) (locked: unlock with TL Creds)
- CVE-2026-109518 dpkg Maintainer Script Spawning Download or Reverse-Shell Tooling (Post-Exploitation) (locked: unlock with TL Creds)
- CVE-2026-109518 dpkg or dpkg-deb Initiating Outbound Network Connections (C2 After Package Swap) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [The Hacker News: Debian and Ubuntu APT Flaw Lets MitM Attackers Swap Verified Packages and Run Code as Root](https://thehackernews.com/2026/11/debian-and-ubuntu-apt-flaw-lets-mitm.html)
- [Debian Security Advisory DSA-6607-1 (apt)](https://lists.debian.org/debian-security-announce/2026/msg00526.html)
- [Ubuntu Security: CVE-2026-109518](https://ubuntu.com/security/CVE-2026-109518)
- [APT developers announcement APT-2026-11-01](https://lists.debian.org/deity/2026/11/msg00005.html)
- [NVD: CVE-2026-109518](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-109518)
- [Debian LTS Advisory DLA-4880-1 (apt, bookworm)](https://lists.debian.org/debian-lts-announce/2026/11/msg00004.html)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5253