Debian Fixes APT Vulnerability That Could Allow Root Code Execution

A flaw in APT’s handling of resumed HTTP downloads could let a man-in-the-middle attacker replace a package after verification. Debian says the issue is fixed in APT 3.0.4 for the stable Trixie distribution.

4 Nov 2026

Debian has issued a security advisory for a vulnerability in its APT package manager that could allow a man-in-the-middle attacker to execute arbitrary code with root privileges. The flaw is tracked as CVE-2026-109518, though a full report had not been made public at the time of the advisory described here.

According to Debian’s DSA 6607-1, APT can combine two separate package downloads if an HTTP redirect causes them to share the same URI. When resuming an HTTP download, improper file handling could allow an attacker to replace a package after it has been verified, leading to code execution as root.

Debian says the vulnerability is fixed for the stable Trixie distribution in APT version 3.0.4. The update also addresses several out-of-bounds access issues, and Debian recommends upgrading APT packages.

Sources: Phoronix.