CVE-2026-109518: apt Flaw Lets Attackers Swap Packages After Verification and Run Code as Root
Read original article ↗AI Summary
CVE-2026-109518 is a critical vulnerability in the apt package manager used by Debian, Ubuntu, and their derivatives, allowing an on-path attacker to swap a package after its hash verification and execute arbitrary code as root. The flaw exploits apt's HTTP download resume functionality, where an attacker can merge two downloads, force a retry, and overwrite the verified file with a malicious payload before installation. This affects systems with non-zero Acquire::Retries settings, which is default in Debian 12+ and Ubuntu 22.04+, impacting CI/CD pipelines, container builds, and developer machines that install packages over untrusted or compromised networks.
AI-extracted · verify before operational use
No entities or IoCs were extracted from this article.