Vulnerabilitymedium
CVE-2026-109518: RCE in Debian apt package manager
Original title: CVE-2026-109518: RCE in apt(1) (DSA 6607-1)
AI summary · x-ai/grok-4.7Summaries by Vani AI
Debian advisory reveals man-in-the-middle vulnerability in APT allowing package replacement.
Max Justicz discovered a vulnerability in the APT package manager. APT can merge two different package downloads after an HTTP redirect gives them the same URI. Improper file handling when resuming an HTTP download allows a man-in-the-middle attacker to replace a package.
Key facts
- Vulnerability in APT package manager
- Allows man-in-the-middle attacker to replace a package
- Discovered by Max Justicz
- Affects Debian Security Advisory DSA 6607-1
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-109518 | Man-in-the-middle RCE in APT on Debian and Ubuntu | 7.7 | <1% | PoC ×2 |
From the original article
Posted by Jan Schaumann on Nov 04 This Debian Security Advisory for CVE-2026-109518 https://lists. debian. org/debian-security-announce/2026/msg00526.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.