Debian has patched a vulnerability in APT, the package manager at the heart of Debian and many Debian-based Linux systems, that could let a man-in-the-middle attacker swap a package after APT has already verified it and run code as root. The flaw is tracked as CVE-2026-109518 and was fixed on November 4, 2026, in apt 3.0.4 for Debian 13 (trixie) and apt 2.6.2 for Debian 12 (bookworm).
Debian credits security researcher Max Justicz with finding the bug. The full technical write-up had not been published at the time of writing, and there is no public proof-of-concept or report of exploitation in the wild.
What Debian confirmed
In DSA-6607-1, Debian says APT can merge 2 different package downloads after an HTTP redirect gives them the same URI. Improper file handling when APT resumes an interrupted HTTP download then allows a man-in-the-middle attacker to replace a package after verification, resulting in the execution of arbitrary code as root.
The advisory says the same update also fixes several out-of-bounds access issues in APT. Debian recommends that all users upgrade their apt packages.
According to the Debian security tracker entry for CVE-2026-109518, the fixed versions are:
- Debian 13 (trixie): vulnerable in
3.0.3, fixed in3.0.4through trixie-security (DSA-6607-1) - Debian 12 (bookworm): vulnerable in
2.6.1, fixed in2.6.2through bookworm-security (DLA-4880-1) - Debian testing (forky) and unstable (sid): listed as vulnerable in
3.3.5at the time of writing, with upstreamapt3.3.6carrying the fix accepted into unstable the same day
How the flaw works
APT protects packages with signed repository metadata and checksums. When it downloads a .deb file, it checks the file against the expected hash before installing it. That check is what normally makes plain HTTP mirrors safe to use: even if someone tampers with traffic, a modified package should fail verification.
CVE-2026-109518 attacks the gap between that check and the install step. Based on Debian’s description, 2 separate downloads can end up pointing at the same file once an HTTP redirect sends them to the same address. When a download is resumed, APT’s handling of that shared target file means content can be changed after the verification step has already passed. Package installation runs as root, so whatever lands in the file at install time gets full control of the system.
The upstream changelog entry for the fix is short: APT’s download methods now open target files exclusively. In practice, that stops 2 downloads from writing to the same file at once.
Who is at risk
The attacker needs to sit in the network path between the machine and its package source, a man-in-the-middle position. Debian’s description also ties the bug to HTTP redirects and resumed HTTP downloads. That means the most exposed systems are those that:
- Pull packages from mirrors over plain
http://rather thanhttps:// - Run updates over untrusted networks such as public Wi-Fi, shared hosting networks or hostile transit links
- Sit behind proxies or mirror redirectors an attacker could tamper with or impersonate
Debian’s advisory does not say whether HTTPS sources fully block the attack, and Debian had not published further detail on preconditions at the time of writing. No CVSS score had been published, and the CVE record had not yet appeared in the public CVE list.
The impact if exploited is severe. A root code execution bug in the package manager hands an attacker the whole machine, the same end result as the remote root issue in the Linux kernel TCP flaw CVE-2026-98432 and the string of privilege escalation bugs covered in Linux root exploits keep piling up. The difference is that this one needs network position and timing, which lowers the odds of mass exploitation.
Ubuntu and other APT-based distributions
APT is also used by Ubuntu, Linux Mint, Raspberry Pi OS, Kali and many other Debian-based systems. Debian’s advisory covers only Debian releases. Canonical had not issued a public security notice for CVE-2026-109518 at the time of writing, and Ubuntu’s package listings did not yet show a patched apt build.
Because these distributions maintain their own APT packages, users should watch their vendor’s security channel for a fixed version rather than assume they are covered by the Debian update.
Why package update channels keep getting targeted
Package managers and update channels are attractive targets because they run with the highest privileges and are trusted by default. BreachNews recently covered the OpsShield cPGuard supply chain attack, where a hijacked update channel pushed a backdoored build that ran as root on about 2,950 hosting servers, and the Alpine Linux GitLab rebuild after attacks on its infrastructure.
There is no sign that CVE-2026-109518 has been used in an attack. It is a reminder, though, that the verification step only protects you if the file that gets installed is the same one that was checked.
How to check and fix your systems
On Debian 12 and Debian 13, the fix arrives through the normal security repository. Refresh package lists and upgrade:
sudo apt update && sudo apt upgrade
Then confirm the installed version:
apt --version
Debian 13 systems should show 3.0.4 or later, and Debian 12 systems should show 2.6.2 or later. Make sure the -security repository is enabled in your APT sources, or the update will not appear.
Until every system is patched, administrators can reduce exposure by:
- Switching APT sources to
https://mirrors where available - Avoiding package updates over untrusted or public networks
- Updating APT itself first, before running large upgrades on unpatched hosts
- Watching Ubuntu, Mint and other vendor security notices for their own fixed
aptbuilds
BreachNews will update this article if Debian, Canonical or the researcher publishes further technical details, a CVSS score or evidence of exploitation.
