Debian APT man-in-the-middle can swap a package after verification and run code as root (CVE-2026-109518)

A flaw in APT, Debian's package manager, lets a man-in-the-middle attacker replace a package after it has been verified, resulting in arbitrary code execution as root. Per Debian's advisory DSA-6607-1, APT can merge two different package downloads after an HTTP redirect gives them the same URI, and improper file handling when resuming an HTTP download allows the swap. It was found by Max Justicz. Debian stable (trixie) is fixed in apt 3.0.4, which also addresses several out-of-bounds access issues. Debian's advisory does not mention exploitation, and Ubuntu and other apt-based distributions had not published their status when this was added.

Why this severity: Root code execution for an attacker in a man-in-the-middle position on package downloads; no CVSS score published yet and no exploitation reported

Started

Nov 4, 2026

CVE

CVE-2026-109518

• Linux
• #Debian
• #APT
• #Package Manager
• #MITM
• RCE