Back Phoronix

Debian's APT Affected By Man-In-The

Phoronix • November 4, 2026

A new vulnerability was disclosed today affecting Debian's APT package manager where a man-in-the-middle attacker could carry out arbitrary code execution as root.

An APT security advisory was issued today due to this vulnerability where improper file handling could lead a man-in-the-middle attacker to execute arbitrary code as root.

This vulnerability is tracked as CVE-2026-109518 though as of writing the report in full hasn't been made public. The

"Max Justicz discovered a vulnerability in the APT package manager. APT can merge two different package downloads after an HTTP redirect gives them the same URI. Improper file handling when resuming an HTTP download allows a man-in-the-middle attacker to replace a package after verification, resulting in the execution of arbitrary code as root.

For the stable distribution (trixie), this problem has been fixed in version 3.0.4. Additionally this update addresses several out-of-bounds access issues.

We recommend that you upgrade your apt packages."

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

High-Risk APT Vulnerability Disclosed for Debian and Ubuntu A vulnerability, tracked as CVE-2026-109518, was disclosed on November 4, 2026, affecting the APT package manager in Debian, Ubuntu, and their derivatives. An on-path attacker can manipulate HTTP traffic to install unverified packages, leading to arbitrary code execution with root privileges. The flaw requires the client to have a non-zero Acquire::Retries configuration setting, which is enabled by default in Debian 12 and Ubuntu 22.04. Security updates have been released for all affected Ubuntu versions, while Debian has also issued patches. The vulnerability has a CVSS score of 7.7, categorized as high severity. Users are advised to switch to HTTPS for APT traffic to mitigate the risk. No confirmed exploitation has been reported yet, but the potential for abuse exists due to the nature of the flaw. 9 sources 67

Extracted Entities

Debian's APT Affected By Man-In-The

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (1)

CWE Weaknesses (2)

MITRE ATT&CK (1)