CVE-2026-109518

Name of the Vulnerable Software and Affected Versions APT versions prior to 3.0.4

Description An on-path attacker capable of manipulating HTTP traffic, such as through a malicious mirror or proxy, can trick an APT client into installing an unverified package to achieve remote code execution with root privileges. The issue stems from a TOCTOU (Time-of-Check to Time-of-Use) race condition combined with hard-link confusion during resumed HTTP downloads. When a redirect assigns the same address to two different downloads, APT may merge them and mishandle the file, allowing an attacker to overwrite a verified .deb archive with malicious content before installation. This exploitation requires the client to follow redirects and have a non-zero Acquire::Retries configuration setting. While HTTPS sources block this attack, a compromised repository mirror can still trigger the vulnerable workflow.

Recommendations Update APT to version 3.0.4 or newer. As a temporary mitigation, set the Acquire::Retries configuration to zero to disable automatic download retries.