{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "Debian APT man-in-the-middle can swap a package after verification and run code as root (CVE-2026-109518) · updates",
  "home_page_url": "https://pwn.watch/i/debian-apt-http-resume-mitm-root-rce-cve-2026-109518",
  "feed_url": "https://pwn.watch/i/debian-apt-http-resume-mitm-root-rce-cve-2026-109518/feed.json",
  "description": "A flaw in APT, Debian's package manager, lets a man-in-the-middle attacker replace a package after it has been verified, resulting in arbitrary code execution as root. Per Debian's advisory DSA-6607-1, APT can merge two different package downloads after an HTTP redirect gives them the same URI, and improper file handling when resuming an HTTP download allows the swap. It was found by Max Justicz. Debian stable (trixie) is fixed in apt 3.0.4, which also addresses several out-of-bounds access issues. Debian's advisory does not mention exploitation, and Ubuntu and other apt-based distributions had not published their status when this was added.",
  "language": "en",
  "_pwn": {
    "slug": "debian-apt-http-resume-mitm-root-rce-cve-2026-109518",
    "severity": "high",
    "status": "live",
    "patchStatus": "patched",
    "rss": "https://pwn.watch/i/debian-apt-http-resume-mitm-root-rce-cve-2026-109518/feed.xml",
    "llms": "https://pwn.watch/i/debian-apt-http-resume-mitm-root-rce-cve-2026-109518/llms.txt",
    "json": "https://pwn.watch/i/debian-apt-http-resume-mitm-root-rce-cve-2026-109518.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/debian-apt-http-resume-mitm-root-rce-cve-2026-109518#2026-11-04-4ebbbd2f",
      "url": "https://pwn.watch/i/debian-apt-http-resume-mitm-root-rce-cve-2026-109518#2026-11-04-4ebbbd2f",
      "title": "Debian APT man-in-the-middle can swap a package after verification and run code as root (CVE-2026-109518): Debian publishes DSA-6607-1 for apt (CVE-2026-109518): a man-in-the-middle attacker can replace a package after verification and run code as root; fixed in apt 3.0.4 for trixie.",
      "content_text": "Debian APT man-in-the-middle can swap a package after verification and run code as root (CVE-2026-109518): Debian publishes DSA-6607-1 for apt (CVE-2026-109518): a man-in-the-middle attacker can replace a package after verification and run code as root; fixed in apt 3.0.4 for trixie.\n\nSource: https://lists.debian.org/debian-security-announce/2026/msg00526.html",
      "date_published": "2026-11-04T00:00:00.000Z",
      "external_url": "https://lists.debian.org/debian-security-announce/2026/msg00526.html",
      "tags": [
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/debian-apt-http-resume-mitm-root-rce-cve-2026-109518#2026-11-04-b4763220",
      "url": "https://pwn.watch/i/debian-apt-http-resume-mitm-root-rce-cve-2026-109518#2026-11-04-b4763220",
      "title": "Debian APT man-in-the-middle can swap a package after verification and run code as root (CVE-2026-109518): The advisory reaches the Hacker News front page.",
      "content_text": "Debian APT man-in-the-middle can swap a package after verification and run code as root (CVE-2026-109518): The advisory reaches the Hacker News front page.\n\nSource: https://news.ycombinator.com/item?id=50364814",
      "date_published": "2026-11-04T00:00:00.000Z",
      "external_url": "https://news.ycombinator.com/item?id=50364814",
      "tags": [
        "high"
      ]
    }
  ]
}