Tracked as CVE-2026-109518, the flaw exploits APT's default behaviour of retrying failed downloads (default since Debian 12 and Ubuntu 22.04) using HTTP redirects and temporary server errors; an attacker can redirect APT to a malicious package during the retry.