Debian fixes APT flaw that could let network attackers run code as root
Debian says a flaw in its APT package manager could let a man-in-the-middle attacker replace a package after verification and execute arbitrary code with root privileges. The vulnerability, CVE-2026-109518, is fixed in APT 3.0.4 for Debian’s stable trixie release; the update also addresses several out-of-bounds access issues.
Bottom line — Debian recommends upgrading APT to version 3.0.4 on trixie.
Go deeper 4
-
Debian’s advisory says the flaw involves two package downloads being merged after an HTTP redirect gives them the same URI.
-
The attack hinges on improper file handling when APT resumes an HTTP download, according to Debian.
-
Security.nl reports that the attacker must be in a man-in-the-middle position; the advisory does not provide further technical details.
-
Debian credits researcher Max Justicz with discovering the vulnerability.