Debian apt security update for CVE-2026-109518
Original title: Debian apt security update (man-in-the-middle)
Max Justicz found vulnerability allowing man-in-the-middle attackers to execute arbitrary code as root after HTTP redirects.
Debian Security Advisory DSA-6607-1 addresses a vulnerability in the APT package manager. APT can merge two different package downloads after an HTTP redirect gives them the same URI. Improper file handling when resuming an HTTP download allows a man-in-the-middle attacker to replace a package after verification, resulting in the execution of arbitrary code as root. The issue is fixed in apt version 3.0.4 for the stable distribution trixie.
- Fixed in version 3.0.4 for trixie
- Affects package downloads via HTTP redirects
- Allows execution of arbitrary code as root
- Also addresses several out-of-bounds access issues
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-109518 | Man-in-the-middle RCE in APT on Debian and Ubuntu | 7.7 | <1% | PoC ×2 |
From the original article
1 min read at lists.debian.org[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index] • Message-id: <[[🔎]](https://lists. debian. org/msgid-search/E1xOZm8-00000002Ddo-3pY0@seger.
By SG · lists.debian.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.