# Debian APT patched against MITM root code execution in CVE-2026-109518

> **Key takeaway:** A man-in-the-middle attacker could exploit improper file handling during resumed HTTP downloads to replace verified packages and execute arbitrary code as root.

**Published:** 2026-11-04T13:10:19+00:00 
**Source:** Phoronix Benchmarks & Drivers 
**Category:** kernel-os 
**Canonical URL:** https://fosswire.org/news/debian-apt-patched-against-mitm-root-code-execution-in-cve-2.html 

## Summary
A critical vulnerability in Debian's APT package manager disclosed today allows man-in-the-middle attackers to achieve arbitrary code execution with root privileges. The flaw, tracked as CVE-2026-109518 and discovered by Max Justicz, stems from APT's improper handling of merged package downloads following HTTP redirects that yield identical URIs. When resuming an HTTP download, a race condition in file handling permits an attacker to substitute a package after its cryptographic verification has already completed.

Debian has issued security advisory DSA 6607-1 with a fix available in APT version 3.0.4 for the stable trixie distribution. The same update also resolves several out-of-bounds access issues found in the package manager. All Debian-based systems and derivatives using APT should apply this update immediately, as the vulnerability compromises the fundamental security guarantee that package verification provides.

## Vulnerability mechanism and patch details
- **HTTP redirect URI collision:** APT can merge two distinct package downloads when an HTTP redirect causes them to share the same URI, creating ambiguity about which package content is actually being installed.
- **Post-verification file replacement:** The core flaw occurs during resumed HTTP downloads, where improper file handling allows a man-in-the-middle attacker to swap package contents after the package has already passed signature verification but before installation completes.
- **Root privilege escalation:** Because APT runs with root privileges during package installation, successful exploitation results in arbitrary code execution as root, giving the attacker complete control of the system.
- **Fixed in APT 3.0.4:** The stable Debian trixie distribution receives the patch in version 3.0.4, which also addresses multiple out-of-bounds access vulnerabilities in the same codebase.
- **CVE-2026-109518 disclosure status:** The full technical report was not yet public at time of disclosure, though the Debian Security Advisory provides sufficient detail for immediate remediation.

## Why it matters
This vulnerability strikes at the core trust model of Debian and all derived distributions including Ubuntu, Linux Mint, and Kali Linux, where APT's verification chain is the primary defense against supply-chain attacks. System administrators running unattended upgrades or operating on untrusted networks face particularly acute exposure, as the MITM vector requires only network position rather than any local access. The fix demands immediate attention across the entire Debian ecosystem, since any delay leaves systems vulnerable to complete compromise during routine package operations.