A Debian apt fix patches a man-in-the-middle route to root

A server building a Docker image, a CI runner, or a Debian machine on unattended upgrades all run apt. Each check the signature on each package. On 4 November, Debian said a bug in apt broke that check. An attacker on the network could replace a package after it. The advisory is DSA-6607-1. The fix is apt 3.0.4 in Debian trixie, the current stable distribution.

What the bug is

Max Justicz discovered the flaw. The report is from Salvatore Bonaccorso at Debian Security. It says apt can merge two different package downloads. That happens when an HTTP redirect gives them the same URI. The bug is in how apt handles a resumed HTTP download. A man-in-the-middle attacker can use it. The attacker replaces a package after the signature check. The attacker's code then runs as root on the target machine.

The CVE identifier is CVE-2026-109518. The same update also fixes several out-of-bounds access issues in apt. Debian lists those without a separate CVE number.

Who is exposed

Any machine that fetches packages over HTTP is exposed to a network attacker on the path. That includes a laptop on a coffee-shop Wi-Fi. It also includes a CI runner that pulls from a non-HTTPS mirror. And it includes a build step in a Dockerfile that calls apt-get update before apt-get install. HTTPS mirrors do not remove the risk. Many mirror setups redirect to HTTP for fetches, and apt follows the redirect.

Ubuntu is not named in the Debian advisory. Ubuntu's apt is a downstream of Debian's. So a matching Ubuntu Security Notice is the next thing to watch. Both distributions have had apt-level security fixes land together before.

What a team should do today

Run the apt upgrade on every Debian trixie machine. Not only servers. Rebuild any Docker base image that calls apt in its build. The fix has to be in the image, not the host. Check any mirror configuration that is still on HTTP. Switch to a mirror that supports HTTPS end to end if possible. Pin a CI base image to a digest tagged after 4 November, so the patched version is cached.

The reach of the problem is set by apt, not by the flaw itself. apt is the default package manager on Debian and Ubuntu. It sits in almost every Linux developer workflow. A build process that is years old may still fetch over HTTP, and nobody remembers. A machine that has not run security updates this week is still exposed. The two-minute fix is the reason to run the patch now, not at the next maintenance window.

Source

• DSA-6607-1 apt security update, Debian Security Announce, Salvatore Bonaccorso.
• apt security tracker, Debian.