Introduction

Max Justicz discovered and responsibly disclosed a vulnerability in APT, the package manager used in Debian, Ubuntu, and derivative Linux distributions. The vulnerability has been assigned the identifier CVE-2026-109518 and has a severity of High. An on-path attacker who can manipulate the HTTP traffic between a system and an archive server can trigger the installation of an attacker-controlled .deb package file and obtain root privileges on the target system. We have released security updates for all affected Ubuntu releases. Ubuntu 22.04 LTS (Jammy Jellyfish) and newer releases are affected by default; older releases are only affected if the Acquire::Retries APT configuration setting is set to a non-zero value.

The vulnerability has a CVSS 4.0 score of 7.7, corresponding to a severity of High (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N).

The vulnerability exists in the HTTP backend invoked by the APT library, and affects any APT-based frontend (apt, apt-get, aptitude, or any of the Ubuntu graphical applications).

The vulnerability does not affect software installation via snap packages, as snaps use a different package management system.

The use of TLS via HTTPS protects against this vulnerability, as exploitation requires the attacker to manipulate HTTP traffic. This post describes how to enable HTTPS for APT traffic. Other transport methods (such as FTP) are not affected by this vulnerability.

The vulnerability requires the client to retry a failed download. This is controlled by the Acquire::Retries APT configuration setting. If this is set to 0, no downloads are retried and the vulnerability cannot be exploited. This configuration setting is only set to a non-zero value in Ubuntu 22.04 LTS (Jammy Jellyfish) and newer releases.

Which Ubuntu releases are affected by CVE-2026-109518?

How to check if you are impacted by CVE-2026-109518

Compare the version of the installed packages from the APT source with the versions in the table above.

apt list --installed '?source-package(^apt$)'

Impact of CVE-2026-109518

An attacker can exploit the vulnerability only if the target system attempts to install a .deb package. An on-path attacker that can manipulate the HTTP traffic between the APT client and the archive server used can replace one of the package files retrieved with an-attacker controlled one. Normally, the archive signature scheme protects against this kind of attack. However, the vulnerability allows an attacker to trick APT into installing a package even if it fails signature verification.

When the system installs a .deb package, it executes the package’s scripts with root privileges. Therefore, the installation of untrusted packages is strongly discouraged as it leads to system compromise. This vector can be used by an attacker who can exploit the vulnerability to achieve root privileges on the target system.

A malicious package mirror can similarly exploit the vulnerability to deliver unsigned, malicious packages to target systems. The archive signature scheme normally secures package mirrors; therefore, once users update the APT client library on the end-user system, compromised mirrors no longer pose a risk.”

Enabling TLS

If you have concerns about the network path to the selected Ubuntu archive server, you can enable TLS as a mitigating measure. Once this vulnerability is patched, enabling TLS is only necessary as a future precaution. The archive signature scheme remains a much stronger integrity protection safeguard that provides end-to-end verification, not just during transit (as TLS does).

However, where the possibility of an on-path attacker cannot be eliminated, enabling TLS prior to installing the security updates for this vulnerability ensures there is no point in which an attacker could exploit the vulnerability.

To enable TLS, modify the APT sources configured and replace http:// URLs with https:// ones. The APT sources files are in /etc/apt/sources.list and the /etc/apt/sources.list.d/ drop-in directory, using either the DEB22 format in .sources files or the older line-oriented format in .list files.

You can replace all HTTP URLs pointing to the Ubuntu archive to HTTPs ones with the following command:

sudo sed -Ei 's!http://((([a-z]+\.)?archive|security|ports)\.ubuntu\.com)!https://\1!' /etc/apt/sources.list /etc/apt/sources.list.d/*.list /etc/apt/sources.list.d/*.sources

Please note that the command does not modify URLs which may point to other mirrors or package repositories. You should then update the local package list and ensure that no errors occur (which could happen if a package mirror does not support HTTPS):

sudo apt update

Please note that some mirrors operated by the community, including some country-specific mirrors, do not support HTTPS. 

While enabling TLS provides protection against this particular vulnerability when exploited by an on-path attacker, we strongly recommend that you install the security updates, as described in the following section.

How to apply fixes for CVE-2026-109518

Temporarily setting Acquire::Retries to zero while installing this security update provides a mitigation against this vulnerability, whether exploited by an on-path attacker or a potentially malicious mirror.

We recommend you upgrade all packages:

sudo apt update && sudo apt upgrade -o Acquire::Retries=0

If this is not possible, the affected component can be targeted:

sudo apt update && sudo apt install -o Acquire::Retries=0 --only-upgrade '?source-package(^apt$)'

The unattended-upgrades feature is enabled by default for Ubuntu 16.04 LTS onwards. This service:  

• Applies new security updates every 24 hours automatically.
• If you have this enabled, the patches above will be automatically applied within 24 hours of being available.

Ubuntu 26.10, 26.04 LTS, 24.04 LTS, and 22.04 LTS receive these fixes as part of standard support. If you are using Ubuntu 20.04 LTS or older, the Ubuntu Pro subscription offers coverage for up to 15 years. Ubuntu 20.04 LTS and 18.04 LTS are covered by Expanded Security Maintenance (ESM), while Ubuntu 16.04 LTS and 14.04 LTS require ESM with the Legacy add-on. Ubuntu Pro is free for up to 5 machines, or up to 50 machines for community members. Ubuntu Pro also provides access to Landscape which enables you to control the roll-out of security fixes across your estate. Learn more.

References

• https://ubuntu.com/security/CVE-2026-109518
• https://ubuntu.com/security/notices/USN-8996-1