APT Retry Logic Flaw CVE-2026-109518 Enables MitM Package Substitution on Debian 12 and Ubuntu 22.04

The flaw stems from insufficient validation during retry sequences in APT 2.4.15 and later. An attacker positioned on the network path or controlling a mirror can issue redirects and transient errors, forcing APT to fetch attacker-controlled content while preserving original checksums from the initial request. Debian released fixed packages for affected branches while Ubuntu pushed updates to its security archive for 22.04 through 26.10 at 14:25 UTC on November 4. Debian testing remained on vulnerable 3.3.5 at 14:58 UTC.

Max Justicz reported the issue. Official advisories from Debian, Ubuntu, and APT maintainers confirm the attack surface is limited to HTTP but provide no evidence of in-the-wild exploitation. Older releases such as Debian 11 and Ubuntu 20.04 require manual enabling of retries, yet many deployment scripts activate Acquire::Retries regardless. CVSS 4.0 scoring from Ubuntu rates impact at 7.7, reflecting root execution without authentication.

This pattern mirrors prior package manager weaknesses where retry and mirror logic bypassed integrity checks. Supply-chain exposure increases because many distributions still default to HTTP mirrors for performance, creating persistent downgrade paths even when GPG signatures are present. The absence of HTTPS coverage in the advisories leaves open whether TLS-wrapped sources inherit the same retry handling.

Fixed APT versions are now available; systems must update immediately. Expect increased scanning of public mirrors and proxy configurations within the next 72 hours as defenders map exposure. Distributions derived from Debian and Ubuntu face identical retry logic inheritance.