Technology1 min read

Debian apt security update: man-in-the-middle arbitrary code execution

By · Published by Everything Blog

In short

The vulnerability, tracked as CVE-2026-109518, allows APT to merge two different package downloads under specific redirect conditions. If an attacker intercepts the connection, they can swap a package after cryptographic verification takes place, achieving root-level code execution. In response, Debian released APT version 3.0.4 for the stable trixie distribution. This maintenance release also addresses multiple out-of-bounds access vulnerabilities present within the package manager codebase.

Key points

  • Flawed handling during resumed HTTP redirects creates an exploitable condition where dist…: Flawed handling during resumed HTTP redirects creates an exploitable condition where distinct package downloads merge unexpectedly.
  • Applying APT version 3.0.4 remediates the code execution flaw alongside several out-of-bo…: Applying APT version 3.0.4 remediates the code execution flaw alongside several out-of-bounds access vulnerabilities.
  • Debian urges system administrators to upgrade their apt packages promptly to prevent netw…: Debian urges system administrators to upgrade their apt packages promptly to prevent network-based system compromises.

Sources checked by our analysis pipeline: 1

[SECURITY] [DSA 6607-1] apt security update

-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA512

- -------------------------------------------------------------------------

Debian Security Advisory DSA-6607-1 security@debian.org

https://www.debian.org/security/ Salvatore Bonaccorso

November 04, 2026 https://www.debian.org/security/faq

- -------------------------------------------------------------------------

Package : apt

CVE ID : CVE-2026-109518

Max Justicz discovered a vulnerability in the APT package manager. APT

can merge two different package downloads after an HTTP redirect gives

them the same URI. Improper file handling when resuming an HTTP download

allows a man-in-the-middle attacker to replace a package after

verification, resulting in the execution of arbitrary code as root.

For the stable distribution (trixie), this problem has been fixed in

version 3.0.4. Additionally this update addresses several out-of-bounds

access issues.

We recommend that you upgrade your apt packages.

For the detailed security status of apt please refer to

its security tracker page at:

https://security-tracker.debian.org/tracker/apt

Further information about Debian Security Advisories, how to apply

these updates to your system and frequently asked questions can be

found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org

-----BEGIN PGP SIGNATURE-----

iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmrrH7dfFIAAAAAALgAo

aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2

NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND

z0Sn4RAAiiQ1hEeN76ANeF3IeVAzYi+0bzUs91pkeLW6eGRlRfEgQX/wLfQ0ewkh

8nmaxpWW4ZCm+1jcwuu/MtNJgVx0ALgJ9cNNS/3CkQJmT0BVnj5ORgY/MHwwRCa+

lU6JkTiAYcQflM//9gFZjvGJMYvVMs8RFqukkLHZoV4CAhLLk3yjQhCxkFa6rjeA

9+1U7lYjuWXQLm/lv+gy9Kp+CvGFuoEuG8v8EI+mAthUmcY4uCFb1Kf8X1XDMJLD

YTNYnIucJ3eAhmPtdZcjVAuGR0BxigJmzrKSthV+gkY62shH/aH8UPzCaic/MoSk

OXgi7gQgGT3tLqE2s7jGzdUG9ZUihA6ZHmqQgUrFUcu3KlQ/90H6hkxiFvwtX9E8

iTmhNXfFzmO/0YErF9V1/5XBqee+gaj2s919nLljjridutuYrjINpHjm3jkv1QWo

+kN9/bAF9ooVxRvMnY1EjMhHSt4s4tZrwTQwil8oSM+hDovascWMRzz8DBBl9KSf

n85yBboNXV951YJEeprNDK9FcIHaApZzuFiIlrN2MoifTGhJGyJ8k9qtSKpnGdKf

vT7/B9x7rZANn3ltOm8KEaSlieznUmLL5u0ZZGhqs/Dus5CKKTE+8+mvo+CmaJQm

ChA8vvi41w4gQiP/2W59NF1ECJlzykNMFposuJsoFXNoMp36PLM=

=VlLy

-----END PGP SIGNATURE-----

Technology

More in Technology