Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilityhigh

Debian APT Vulnerability Enables Man-in-the-Middle Root Code Execution

7 sources · 8 articlesFirst reported Updated ()1
What's new

November 5: CSO Online reports CVE-2026-109518 allows MITM package replacement via HTTP redirects and retries, rated CVSS v4.0 7.7; adds Ubuntu patch details and hard link mishandling.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

CVE-2026-109518 in APT lets on-path attackers replace verified packages and execute code as root after HTTP redirects; fixed in Debian 3.0.4 and multiple Ubuntu versions.

Max Justicz discovered a flaw in Debian's APT package manager where an attacker who can intercept HTTP traffic can force APT to merge package downloads after a redirect shares the same URI. This replaces a verified package with a malicious one, enabling arbitrary code execution as root. The issue also affects Ubuntu derivatives due to shared APT handling of redirects and retries. No active exploitation has been reported. Debian and Ubuntu issued fixes addressing the vulnerability and related out-of-bounds errors.

Key facts
  • CVE-2026-109518
  • Discovered by Max Justicz
  • Fixed in APT 3.0.4 (Debian Trixie)
  • Affects Debian Bookworm before 2.6.2
  • Requires following redirects and non-zero retries
  • No active exploitation reported
Analyze CVE-2026-109518 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Nov 4, 2026Max Justicz discovers APT vulnerability allowing man-in-the-middle package replacement after HTTP redirects · Hacker News
  2. Nov 4, 2026Debian issues DSA 6607-1 fixing APT in version 3.0.4 · Hacker News
  3. Nov 4, 2026Ubuntu Security Notice USN-8996-1 describes APT root code execution flaw · Ubuntu Security Notices
  4. Nov 4, 2026Cyber Security News reports Debian APT flaw enabling RCE as root via redirects · Cyber Security News
  5. Nov 4, 2026The Hacker News covers Debian and Ubuntu APT flaw with default retries · The Hacker News
  6. Nov 5, 2026GBHackers reports Debian Ubuntu APT vulnerability with CVSS 7.7 · GBHackers

What each outlet adds

beyond the shared facts
  • Hacker NewsDetails discovery by Max Justicz and out-of-bounds access fixes
  • Ubuntu Security NoticesSpecific USN-8996-1 and Ubuntu version impacts
  • Cyber Security NewsExact vulnerable versions for Bookworm and Trixie
  • The Hacker NewsMentions default retry settings in Debian 12 and Ubuntu 22.04+
  • CSO OnlineNew details on hard link overrides during redirects and MITM specifics
CVEs
CVE-2026-109518
Vendors
DebianCanonicalUbuntudebianubuntu
Products
APTapt
Countries
Germany

Coverage

oldest first · one row per article · UTC
  1. · 5d ago Hacker News · securityFirst report

    Debian apt security update fixes man-in-the-middle code execution

    Max Justicz discovered a vulnerability in apt allowing man-in-the-middle attackers to execute arbitrary code as root by merging package downloads; fixed in version 3.0.4.

  2. · 5d ago Ubuntu Security Notices

    APT mishandles hard links allowing remote code execution

    A remote on-path attacker can trick APT into installing an unverified package and achieve root-level remote code execution.

  3. · 5d ago Hacker News · security

    Debian apt security update for CVE-2026-109518

    Max Justicz found vulnerability allowing man-in-the-middle attackers to execute arbitrary code as root after HTTP redirects.

  4. · 4d ago Cyber Security News

    Debian APT flaw lets attackers hijack updates and run code as root

    CVE-2026-109518 in APT allows network attackers to replace verified packages and execute code as root on Debian releases.

  5. · 4d ago The Hacker News

    Debian and Ubuntu APT flaw allows package swap

    The flaw in APT lets MitM attackers swap verified packages and run code as root when retries are enabled.

  6. · 4d ago oss-security

    CVE-2026-109518: RCE in Debian apt package manager

    Debian advisory reveals man-in-the-middle vulnerability in APT allowing package replacement.

  7. · 4d ago GBHackers

    Debian and Ubuntu APT Vulnerability Allows Root Code Execution (CVE-2026-109518)

    CVE-2026-109518 in APT lets on-path attackers install malicious packages with root privileges via HTTP redirects and retry mishandling.

  8. · 4d ago CSO Online

    Debian Ubuntu patch APT flaw allowing root via redirects

    CVE-2026-109518 in APT lets MITM attackers install packages with root privileges using HTTP redirects and retries.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-109518
Man-in-the-middle RCE in APT on Debian and Ubuntu
7.7<1%PoC ×2