Debian Patches APT Flaw Allowing Man-in-the-Middle Attackers to Execute Code as Root
Vulnerability Disclosure · 13 sources · Updated 12m ago · First seen Nov 4, 2026
Debian patched CVE-2026-109518, a vulnerability in its APT package manager that could allow a man-in-the-middle attacker to replace a package after verification and execute arbitrary code as root. The flaw combines HTTP redirects that cause separate package downloads to share a target file with improper file handling when interrupted HTTP downloads resume, undermining package verification protections.
Administrators should upgrade to APT 3.0.4 for Debian 13 (trixie) or APT 2.6.2 for Debian 12; upstream APT 3.3.6 also includes the fix. Debian advisory DSA-6607-1 additionally addresses several out-of-bounds access issues. At publication, full technical details remained unpublished, and no public proof of concept, exploitation report, or CVSS score was available. Using HTTPS mirrors and avoiding updates over untrusted networks may reduce exposure, but Debian had not confirmed whether HTTPS fully prevents exploitation; these precautions should not replace patching.
