Debian patches apt against a man-in-the-middle code execution flaw

Debian has released a security update for apt. apt is the package manager on Debian and on every Debian-based distribution. The advisory, DSA-6607-1, is dated 4 November 2026. It is signed by Salvatore Bonaccorso. Debian says the fix is in apt 3.0.4 on the stable release, trixie.

The bug is tracked as CVE-2026-109518. Max Justicz found it. Debian's advisory says apt could merge two different package downloads when an HTTP redirect gave them the same URI. Debian also says a second problem made this exploitable. apt did not handle files correctly when it resumed a download over HTTP. A man-in-the-middle attacker could then replace the package after apt had already verified it. The attacker's code would run as root.

Why the signature check did not help

apt signs every package it installs. The signature is meant to stop exactly this kind of swap. The hole is that the swap happens later in the flow than the check. Debian says the attacker replaces the content after verification. apt resumes the HTTP download, and the new bytes come in. The signed index apt consulted is still valid. The bytes on disk are not what it signed.

A reader who runs apt behind a trusted mirror on a trusted network has less to worry about here. A reader on a cafe Wi-Fi or a shared office network has more to worry about. That is exactly the position the advisory describes.

There are also out-of-bounds reads in the same release

The advisory says the same 3.0.4 release fixes "multiple out-of-bounds access issues" alongside CVE-2026-109518. Debian does not list a separate CVE for those in the message. It points readers to its security tracker at security-tracker.debian.org for the full status of the apt package.

The fix is on trixie only. The advisory does not name oldstable, testing or unstable. A reader on an older Debian release or on a derivative distribution should check their own vendor's advisory page first.

What to do, today

Debian's recommendation is one sentence: "We recommend that you upgrade your apt packages." On a trixie host that is apt update && apt upgrade. The same step runs through any configuration-management tool.

A team that builds container images on top of Debian should rebuild those images against the patched base. Then roll them out before the next run that could pull a package over a hostile link. A team that runs a mirror should pull the fix down first. A team that runs Debian on a network they do not fully control should treat this as a patch-today item.

The flaw rewards an attacker who already sits on the network path between a Debian machine and its mirror. Many networks have such an attacker available. That is why Debian treats this as a security advisory, not a stability one.

Source

• DSA-6607-1 apt security update, Debian Security
• Debian apt security tracker