Debian Patches apt Flaw That Lets an Attacker Swap a Package After It Passes Verification

Debian published Security Advisory DSA-6607-1 on November 4, 2026, covering a vulnerability in apt, the package manager, identified as CVE-2026-109518. Max Justicz discovered the flaw. For the stable distribution trixie, the problem is fixed in apt version 3.0.4, and Debian recommends that users upgrade their apt packages.

The advisory describes two conditions that combine into the attack path. First, APT can merge two different package downloads after an HTTP redirect (a server response that sends the client to another address) gives them the same URI (the identifier used to name a resource). Second, improper file handling when resuming an HTTP download (picking up a partly finished transfer where it stopped) allows a man-in-the-middle attacker (someone positioned between the client and the server on the network) to replace a package after verification, resulting in execution of arbitrary code as root (commands run with full administrative privileges).

The ordering matters to anyone auditing an update pipeline. The substitution happens after the package has passed verification, so the integrity check on the package does not protect the bytes that are ultimately installed.

The same update also addresses several out-of-bounds access issues in apt, where a program reads or writes memory outside the region it was meant to use.

The advisory arrived in a short run of Debian security announcements. DSA-6602-1 for the linux package and DSA-6605-1 for chromium were both published on November 2, 2026. DSA-6606-1 for squid followed on November 3, and DSA-6607-1 for apt on November 4. Debian states that it coordinates many of its advisories with other free software vendors and publishes on the same day a vulnerability is made public, which is consistent with the timing of this batch.

The apt package has a history of network-facing flaws. In September 2014, DSA 3031-1 addressed a buffer overflow in the HTTP transport code in apt-get, which the Google Security Team discovered. CVE-2012-0954, which concerns apt-key net-update, describes a remote attacker installing altered packages through a man-in-the-middle attack. On January 22, 2019, Debian published DSA 4371-1 and DLA 1637-1, both covering a flaw that let an attacker positioned between APT and a mirror (a server that copies the official package archive) inject malicious content into HTTP traffic. DSA 3733-1, published December 13, 2016, was another apt security update. The attack surface is the same in each case: the transport layer between the package manager and the mirror, where the client trusts that what arrives over the wire is what it asked for.

The broader context here is that the redirect and resume logic in CVE-2026-109518 sits on that same surface. Package signature verification remains the control that catches tampered content, but this class of bug makes the verification order and the download state machine (the sequence of steps a download moves through) the weak point.

In my view, the lesson for operators is less about apt itself than about how much of an update path depends on transport-level assumptions being correct.

For administrators, the practical steps are the ones Debian lists. The advisory recommends upgrading apt packages, and the fixed version for trixie is 3.0.4. Debian advises users to subscribe to the debian-security-announce mailing list to receive the latest security advisories. For systems that should stay current without manual intervention, Debian notes that installing the unattended-upgrades package keeps a computer up to date with the latest security updates automatically.

Hosts that fetch packages over plain HTTP from untrusted or intermediate networks carry the most exposure to a man-in-the-middle position, and those environments are where patch ordering matters most. Fleets that mirror packages internally should confirm that their mirror and client apt versions both reflect the fix, since the client is the component performing the download resumption and verification.