# CVE-2026-109518: apt Flaw Lets Attackers Swap Packages After Verification and Run Code as Root

apt's HTTP download resume logic lets an on-path attacker merge two downloads via redirects and overwrite a hash-verified package with a malicious one, running code as root.

- Payout: Research
- Severity: high
- Program: apt
- Found by (vendor credit): Max Justicz
- Write-up by: StepSecurity
- Disclosed: 2026-11-05
- CVE: CVE-2026-109518
- Write-up quality: 7/10
- Original: https://www.stepsecurity.io/blog/cve-2026-109518-apt-package-swap-root
- Library page: https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-cve-2026-109518-apt-package-swap-root
- Tags: area:oss domain:infra domain:oss impact:integrity impact:rce kind:research platform:threat-intel sev:high tech:linux technique:chained technique:race-window vuln:race-condition vuln:rce

**Target:** apt HTTP package download/resume code (Acquire::Retries)
**Root cause:** apt mishandles hard links used when merging two redirected downloads into one file; a resumed transfer overwrites the hard-linked file after the hash check, so the installed file differs from the verified one (TOCTOU).
**Steps:**
1. Attacker answers two different package requests with HTTP redirects pointing to the same URL, so apt treats the two downloads as one file.
2. Attacker returns temporary HTTP server errors to force apt to retry and resume the download (requires Acquire::Retries > 0).
3. After apt verifies the hash, the resumed transfer overwrites the hard-linked file with the attacker's payload.
4. apt installs the attacker's package; dpkg runs its postinst as root.
**How found:** Not stated; text notes Max Justicz also found the similar CVE-2019-3462 apt HTTP download bug.
**Exploitation:** On-path attacker (compromised network, malicious mirror, proxy/cache) controls HTTP responses to apt. They redirect two package requests to one URL, force retries with temporary server errors, and overwrite the hard-linked file post-verification with a malicious package whose maintainer script runs as root, yielding full machine control and access to CI secrets, tokens, and credentials.
**Escalation:** Root code execution via dpkg maintainer scripts; on CI runners exposes GITHUB_TOKEN, cloud credentials, signing keys; in Docker builds bakes attacker code into shipped images.
**Insight:** Package-manager integrity checks that verify a file then install it are vulnerable to TOCTOU when resume/retry logic reuses hard links; look at download-resume and redirect-merge code paths where the checked file can be replaced before use.