# Debian APT man-in-the-middle can swap a package after verification and run code as root (CVE-2026-109518) · pwn.watch

> A flaw in APT, Debian's package manager, lets a man-in-the-middle attacker replace a package after it has been verified, resulting in arbitrary code execution as root. Per Debian's advisory DSA-6607-1, APT can merge two different package downloads after an HTTP redirect gives them the same URI, and improper file handling when resuming an HTTP download allows the swap. It was found by Max Justicz. Debian stable (trixie) is fixed in apt 3.0.4, which also addresses several out-of-bounds access issues. Debian's advisory does not mention exploitation, and Ubuntu and other apt-based distributions had not published their status when this was added.

Page: https://pwn.watch/i/debian-apt-http-resume-mitm-root-rce-cve-2026-109518 · generated 2026-11-04T15:19:03.586Z

## Status
- Severity: high · status: live · patch: patched
- Product: APT package manager (Debian)
- Started: 2026-11-04
- CVEs: CVE-2026-109518
- Affected: apt in Debian stable (trixie) before 3.0.4
- Fixed in: apt 3.0.4 (Debian trixie, DSA-6607-1)

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/debian-apt-http-resume-mitm-root-rce-cve-2026-109518/feed.xml
- JSON Feed: https://pwn.watch/i/debian-apt-http-resume-mitm-root-rce-cve-2026-109518/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/debian-apt-http-resume-mitm-root-rce-cve-2026-109518.json
- This file: https://pwn.watch/i/debian-apt-http-resume-mitm-root-rce-cve-2026-109518/llms.txt

## Updates (newest first)
- 2026-11-04: Debian publishes DSA-6607-1 for apt (CVE-2026-109518): a man-in-the-middle attacker can replace a package after verification and run code as root; fixed in apt 3.0.4 for trixie. (https://lists.debian.org/debian-security-announce/2026/msg00526.html)
- 2026-11-04: The advisory reaches the Hacker News front page. (https://news.ycombinator.com/item?id=50364814)

## Fix brief
# Security brief: Debian APT man-in-the-middle can swap a package after verification and run code as root (CVE-2026-109518)

Source: https://pwn.watch/i/debian-apt-http-resume-mitm-root-rce-cve-2026-109518 · status: live · severity: high · updated Nov 4, 2026, 13:57 UTC

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
A flaw in APT, Debian's package manager, lets a man-in-the-middle attacker replace a package after it has been verified, resulting in arbitrary code execution as root. Per Debian's advisory DSA-6607-1, APT can merge two different package downloads after an HTTP redirect gives them the same URI, and improper file handling when resuming an HTTP download allows the swap. It was found by Max Justicz. Debian stable (trixie) is fixed in apt 3.0.4, which also addresses several out-of-bounds access issues. Debian's advisory does not mention exploitation, and Ubuntu and other apt-based distributions had not published their status when this was added.

Severity detail: Root code execution for an attacker in a man-in-the-middle position on package downloads; no CVSS score published yet and no exploitation reported

- Product: APT package manager (Debian)
- CVE / advisory ids: CVE-2026-109518

## Affected versions
- apt in Debian stable (trixie) before 3.0.4

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- apt 3.0.4 (Debian trixie, DSA-6607-1)

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Specific notes
On Debian trixie hosts and images, run apt update && apt install apt, then confirm apt --version shows 3.0.4 or later. Rebuild container images based on Debian. Until patched, prefer HTTPS mirrors so a network attacker can't sit in the middle of package downloads. Check your distribution's security tracker if you run Ubuntu or another apt-based distro.

## Latest updates
- Nov 4, 2026: Debian publishes DSA-6607-1 for apt (CVE-2026-109518): a man-in-the-middle attacker can replace a package after verification and run code as root; fixed in apt 3.0.4 for trixie.
- Nov 4, 2026: The advisory reaches the Hacker News front page.

## Advisories
- [[SECURITY] [DSA 6607-1] apt security update](https://lists.debian.org/debian-security-announce/2026/msg00526.html) (Debian)

## Write-ups & news
- [Debian apt security update: man-in-the-middle arbitrary code execution](https://news.ycombinator.com/item?id=50364814)

---
Machine-readable: https://pwn.watch/i/debian-apt-http-resume-mitm-root-rce-cve-2026-109518.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.