Debian DSA-6607-1: apt flaw let a network attacker swap a verified package and run root code

Victoria Shinder05 November 2026, 09:041 min read

Debian published security advisory DSA-6607-1 for apt on 4 November, signed by Salvatore Bonaccorso. The issue, CVE-2026-109518, was discovered by Max Justicz.

According to the advisory, APT can merge two different package downloads after an HTTP redirect gives them the same URI. Improper file handling when an HTTP download is resumed then allows a man-in-the-middle attacker to replace a package after it has been verified, which results in the execution of arbitrary code as root. The attacker therefore does not need to break signature checking; the swap happens after the check has passed.

For the stable distribution, trixie, the problem is fixed in apt 3.0.4. The same update addresses several out-of-bounds access issues. Debian recommends that users upgrade their apt packages and points to the security tracker page for apt for the status in other releases.

What it means

Package signatures protect what was checked, not what is later read from disk. The advisory's own recommendation is the whole action: upgrade apt.