CVE-2026-109518 APT vulnerability fixes available

Key points

Canonical has released fixed apt packages for every affected Ubuntu release after Max Justicz reported CVE-2026-109518, a High-severity flaw in APT's HTTP backend. An on-path attacker who can tamper with HTTP traffic between a system and an archive server can get an attacker-controlled .deb installed, even though it fails signature verification, and gain root. Ubuntu 22.04 LTS and newer are affected by default; older releases only if Acquire::Retries is set to a non-zero value.

The vulnerability

• CVSS 4.0 score 7.7 (High): CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N.
• The bug is in the HTTP backend used by the APT library, so it affects every APT frontend: apt, apt-get, aptitude and Ubuntu's graphical tools.
• Exploitation needs the client to retry a failed download. With Acquire::Retries set to 0, nothing is retried and the flaw cannot be used. Only Ubuntu 22.04 LTS and newer set it to a non-zero value by default.
• HTTPS (TLS) protects against it, because the attacker must manipulate HTTP traffic. FTP and other transports are not affected.
• Snap packages are not affected, since snaps use a different package management system.
• The USN for the fix is USN-8996-1.

Impact

• The attack only works when the target system installs a .deb package.
• The attacker swaps one of the downloaded package files for their own. The archive signature scheme would normally stop this, but the flaw lets APT install the package anyway.
• Package maintainer scripts run as root during installation, so this gives the attacker root on the system.
• A malicious mirror can use the same flaw to deliver unsigned packages. Once the APT client is updated, compromised mirrors are no longer a risk, because signatures are enforced again.

**Fixed versions of apt**

• 14.04 LTS (Trusty): 1.0.1ubuntu2.24+esm4
• 16.04 LTS (Xenial): 1.2.36+esm1
• 18.04 LTS (Bionic): 1.6.19+esm1
• 20.04 LTS (Focal): 2.0.12+esm1
• 22.04 LTS (Jammy): 2.4.15ubuntu0.1
• 24.04 LTS (Noble): 2.8.4ubuntu0.1
• 26.04 LTS (Resolute): 3.2.1ubuntu0.1
• 26.10 (Stonking): 3.3.3ubuntu0.1
• Ubuntu 26.10, 26.04 LTS, 24.04 LTS and 22.04 LTS get the fix under standard support. 20.04 LTS and 18.04 LTS need Ubuntu Pro's Expanded Security Maintenance (ESM); 16.04 LTS and 14.04 LTS need ESM with the Legacy add-on.

Check and update

• Compare the installed version with the table above:

apt list --installed '?source-package(^apt$)'

• Setting Acquire::Retries to 0 while installing the update protects the update itself, against both an on-path attacker and a malicious mirror. Canonical recommends upgrading all packages, or only the APT packages if that is not possible:

sudo apt update && sudo apt upgrade -o Acquire::Retries=0
sudo apt update && sudo apt install -o Acquire::Retries=0 --only-upgrade '?source-package(^apt$)'

• Unattended-upgrades is on by default from Ubuntu 16.04 LTS and applies security updates every 24 hours, so systems with it enabled get the fix within a day of release.

Optional: switch APT to HTTPS

• Where an on-path attacker cannot be ruled out, enabling TLS before installing the update closes the window completely. After patching, TLS is only a future precaution; the archive signatures remain the stronger, end-to-end protection.
• APT sources live in /etc/apt/sources.list and /etc/apt/sources.list.d/ (deb822 .sources files or older .list files). This command switches the Ubuntu archive, security and ports URLs to HTTPS, leaving other mirrors and repositories untouched:

sudo sed -Ei 's!http://((([a-z]+\.)?archive|security|ports)\.ubuntu\.com)!https://\1!' /etc/apt/sources.list /etc/apt/sources.list.d/*.list /etc/apt/sources.list.d/*.sources
sudo apt update

• Check that apt update runs without errors: some community mirrors, including some country-specific ones, do not support HTTPS.

Summary by DistroNews, based on the original post.