# Debian APT update fixes root code-execution vulnerability (DSA-6607-1)

**URL:** <https://forum.hhf.technology/t/debian-apt-update-fixes-root-code-execution-vulnerability-dsa-6607-1/4697>\
**Category:** 🚨→Security Advisory→🚨\
**Tags:** debian, cve, security, urgent\
**Created:** [November 4, 2026, 5:37pm UTC](https://forum.hhf.technology/t/debian-apt-update-fixes-root-code-execution-vulnerability-dsa-6607-1/4697 "2026-11-04T17:37:10Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![hhf.technoloy](https://forum.hhf.technology/user_avatar/forum.hhf.technology/hhf.technoloy/32/68_2.png) [@hhf.technoloy](https://forum.hhf.technology/u/hhf.technoloy)\
**Post date:** [November 4, 2026, 5:37pm UTC](https://forum.hhf.technology/t/debian-apt-update-fixes-root-code-execution-vulnerability-dsa-6607-1/4697/1 "2026-11-04T17:37:10Z")

</div>

**Status checked: 4 November 2026**

A Debian security update fixes a vulnerability in APT that could let a network attacker replace a package after verification and cause it to run code as root.

### At a glance

- **Package:** `apt`

- **CVE:** [CVE-2026-109518](https://security-tracker.debian.org/tracker/CVE-2026-109518)

- **Fixed in Debian stable (trixie):** `apt` 3.0.4

- **Action:** Update APT from your configured Debian repositories.

### What’s the issue?

APT could merge separate package downloads when an HTTP redirect made them resolve to the same URI. In combination with improper handling of a resumed HTTP download, a man-in-the-middle attacker could replace a package after verification. Successful exploitation could result in arbitrary code running as root.

The update also addresses several out-of-bounds access issues.

### What to do

On Debian trixie, install the available `apt` update and confirm the installed version is **3.0.4 or newer**. If you use another Debian release or a Debian-based distribution, check its security tracker for the package version applicable to your system.

**References**

- [Debian DSA-6607-1: apt security update](https://lists.debian.org/debian-security-announce/2026/msg00526.html)

- [Debian security tracker: apt](https://security-tracker.debian.org/tracker/apt)

- [Debian security information](https://www.debian.org/security/)

For discussion, use Firewalls & Security.