Debian apt security update fixes man-in-the-middle code execution
Original title: Debian apt security update: man-in-the-middle arbitrary code execution
Max Justicz discovered a vulnerability in apt allowing man-in-the-middle attackers to execute arbitrary code as root by merging package downloads; fixed in version 3.0.4.
Debian Security Advisory DSA 6607-1 addresses a vulnerability in the apt package manager. The flaw allows a man-in-the-middle attacker to replace a package after verification by merging two different package downloads with the same URI after an HTTP redirect. This results in arbitrary code execution as root. The update also fixes several out-of-bounds access issues. The fix is available in version 3.0.4 for the trixie distribution.
- Improper file handling when resuming HTTP download allows package replacement
- Arbitrary code execution as root possible
- Fixed in apt version 3.0.4
- Addresses out-of-bounds access issues as well
Impact: arbitrary code execution as root via man-in-the-middle attack on package downloads
- 1.Upgrade apt to version 3.0.4
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-109518 | Man-in-the-middle RCE in APT on Debian and Ubuntu | 7.7 | <1% | PoC ×2 |
From the original article
1 min read at lists.debian.orgFinal URL: https://lists. debian. org/debian-security-announce/2026/msg00526.
By vesinisa · lists.debian.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.