Technology1 min read

Debian apt security update (man-in-the-middle)

By · Published by Everything Blog

In short

The vulnerability enables the package manager to merge two separate downloads if an HTTP redirect assigns them identical URIs. A man-in-the-middle attacker could exploit this behavior to substitute a legitimate package after verification and gain full root control. Debian resolved the issue for the stable trixie distribution by releasing version 3.0.4. Alongside fixing the redirect flaw, the maintenance release patches several out-of-bounds access vulnerabilities.

Key points

  • Debian users on the stable trixie distribution should update immediately to version 3.0.4.: Debian users on the stable trixie distribution should update immediately to version 3.0.4.
  • Flawed HTTP resume handling previously allowed redirect manipulation to bypass post-verif…: Flawed HTTP resume handling previously allowed redirect manipulation to bypass post-verification package integrity checks.
  • Applying the security release protects underlying operating systems from unauthorized roo…: Applying the security release protects underlying operating systems from unauthorized root-level code execution.

Sources checked by our analysis pipeline: 1

[SECURITY] [DSA 6607-1] apt security update

-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA512

- -------------------------------------------------------------------------

Debian Security Advisory DSA-6607-1 security@debian.org

https://www.debian.org/security/ Salvatore Bonaccorso

November 04, 2026 https://www.debian.org/security/faq

- -------------------------------------------------------------------------

Package : apt

CVE ID : CVE-2026-109518

Max Justicz discovered a vulnerability in the APT package manager. APT

can merge two different package downloads after an HTTP redirect gives

them the same URI. Improper file handling when resuming an HTTP download

allows a man-in-the-middle attacker to replace a package after

verification, resulting in the execution of arbitrary code as root.

For the stable distribution (trixie), this problem has been fixed in

version 3.0.4. Additionally this update addresses several out-of-bounds

access issues.

We recommend that you upgrade your apt packages.

For the detailed security status of apt please refer to

its security tracker page at:

https://security-tracker.debian.org/tracker/apt

Further information about Debian Security Advisories, how to apply

these updates to your system and frequently asked questions can be

found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org

-----BEGIN PGP SIGNATURE-----

iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmrrH7dfFIAAAAAALgAo

aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2

NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND

z0Sn4RAAiiQ1hEeN76ANeF3IeVAzYi+0bzUs91pkeLW6eGRlRfEgQX/wLfQ0ewkh

8nmaxpWW4ZCm+1jcwuu/MtNJgVx0ALgJ9cNNS/3CkQJmT0BVnj5ORgY/MHwwRCa+

lU6JkTiAYcQflM//9gFZjvGJMYvVMs8RFqukkLHZoV4CAhLLk3yjQhCxkFa6rjeA

9+1U7lYjuWXQLm/lv+gy9Kp+CvGFuoEuG8v8EI+mAthUmcY4uCFb1Kf8X1XDMJLD

YTNYnIucJ3eAhmPtdZcjVAuGR0BxigJmzrKSthV+gkY62shH/aH8UPzCaic/MoSk

OXgi7gQgGT3tLqE2s7jGzdUG9ZUihA6ZHmqQgUrFUcu3KlQ/90H6hkxiFvwtX9E8

iTmhNXfFzmO/0YErF9V1/5XBqee+gaj2s919nLljjridutuYrjINpHjm3jkv1QWo

+kN9/bAF9ooVxRvMnY1EjMhHSt4s4tZrwTQwil8oSM+hDovascWMRzz8DBBl9KSf

n85yBboNXV951YJEeprNDK9FcIHaApZzuFiIlrN2MoifTGhJGyJ8k9qtSKpnGdKf

vT7/B9x7rZANn3ltOm8KEaSlieznUmLL5u0ZZGhqs/Dus5CKKTE+8+mvo+CmaJQm

ChA8vvi41w4gQiP/2W59NF1ECJlzykNMFposuJsoFXNoMp36PLM=

=VlLy

-----END PGP SIGNATURE-----

Technology

More in Technology