Status checked: 4 November 2026
A Debian security update fixes a vulnerability in APT that could let a network attacker replace a package after verification and cause it to run code as root.
At a glance
-
Package:
apt -
CVE: CVE-2026-109518
-
Fixed in Debian stable (trixie):
apt3.0.4 -
Action: Update APT from your configured Debian repositories.
What’s the issue?
APT could merge separate package downloads when an HTTP redirect made them resolve to the same URI. In combination with improper handling of a resumed HTTP download, a man-in-the-middle attacker could replace a package after verification. Successful exploitation could result in arbitrary code running as root.
The update also addresses several out-of-bounds access issues.
What to do
On Debian trixie, install the available apt update and confirm the installed version is 3.0.4 or newer. If you use another Debian release or a Debian-based distribution, check its security tracker for the package version applicable to your system.
References
For discussion, use Firewalls & Security.