Debian APT flaw lets network attackers swap packages and run root code

Debian has fixed a flaw in APT, the tool that installs and updates software on Debian and the Linux systems built on it, that lets an attacker who can intercept a machine's traffic replace a package after APT has checked it and run code as root. Debian said in its advisory on 4 November that the bug, CVE-2026-109518, was found by Max Justicz, a researcher who has previously reported remote code execution flaws in package tools and registries including RubyGems, Packagist, Alpine's apk and CocoaPods.

APT checks package signatures so that a tampered download is rejected. This bug lets the swap happen after that check. According to Debian, APT can merge two different package downloads when an HTTP redirect gives them the same address, and it mishandles files when it resumes an interrupted HTTP download. A man-in-the-middle can use this to swap the package after verification. The fix in the apt changelog is one line, "Open target files exclusively", International Cyber Digest noted. The same update also fixes several out-of-bounds memory bugs, Debian says.

Second APT flaw from the same researcher

Justicz found a similar APT bug in 2019, CVE-2019-3462, which also let a man-in-the-middle or a malicious mirror run code as root through APT's handling of HTTP redirects, as he described in his write-up at the time. His advice then was to update with redirects turned off. Debian's new advisory gives no workaround and does not say the flaw has been exploited, and Justicz has not published details of the new bug.

Who is affected and what to do

The fixed versions are apt 3.0.4 for Debian 13 trixie (DSA-6607-1) and apt 2.6.2 for Debian 12 bookworm, now under long-term support. Debian's security tracker still lists the testing and unstable releases, forky and sid, as vulnerable. Debian recommends upgrading apt. The attack needs a man-in-the-middle between the machine and the server it downloads from, so the first to patch should be systems that fetch packages over networks their owners do not control.