# Qubes OS warns of APT package verification bypass in Debian, Whonix qubes

> **Key takeaway:** CVE-2026-109518 in APT allows man-in-the-middle attackers to replace verified packages after HTTP redirect, with Qubes OS issuing QSB-122 because template compromise would cascade to all derived qubes.

**Published:** 2026-11-06T02:04:54.681674+00:00 
**Source:** Qubes OS Official News 
**Category:** mobile-hardened 
**Canonical URL:** https://fosswire.org/news/qubes-os-warns-of-apt-package-verification-bypass-in-debian-.html 

## Summary
Qubes OS has published Security Bulletin 122 addressing CVE-2026-109518, a package verification bypass in APT disclosed by Debian as DSA-6607-1. The flaw, discovered by Max Justicz, occurs when APT merges two different package downloads after an HTTP redirect assigns them the same URI, with improper file handling during resumed HTTP downloads allowing a man-in-the-middle attacker to substitute a package after cryptographic verification has already occurred. This results in arbitrary code execution as root within affected qubes.

Qubes OS systems containing Debian or Whonix qubes are affected; Fedora-only systems are not. While Qubes normally does not issue bulletins for qube-internal vulnerabilities, this case is exceptional because compromised templates would automatically compromise all app and service qubes derived from them, undermining Qubes' template isolation defenses. The Qubes team has released updated packages for version 4.3 and prescribed a specific update sequence: dom0 first via qubes-dom0-update, then Debian and Whonix templates via qubes-vm-update, with direct apt usage explicitly prohibited as it bypasses Qubes OS security measures.

## Vulnerability mechanism and Qubes-specific attack path
- **CVE-2026-109518 / DSA-6607-1:** APT improperly handles file operations when resuming HTTP downloads after a redirect causes two different packages to share the same URI, enabling package substitution post-verification.
- **Attack vector:** Man-in-the-middle position on unauthenticated transport (plain HTTP) or control of a repository mirror; successful exploitation yields arbitrary code execution as root in the targeted qube.
- **Qubes default mitigation:** Debian and Whonix templates use HTTPS for APT repositories by default, which eliminates the man-in-the-middle vector unless users have manually reconfigured to plain HTTP or added unofficial APT-based qubes.
- **Template cascade risk:** Unlike typical qube-internal vulnerabilities, this flaw is bulletin-worthy because compromised templates propagate to all dependent app qubes and service qubes (including privacy-critical Whonix and VPN proxy qubes), subverting Qubes' network-isolated template architecture.
- **Fixed versions:** qubes-core-dom0-linux 4.3.25 and qubes-mgmt-salt-dom0-update 4.3.4 in Qubes 4.3, with the update tools themselves modified to safely sequence APT updates; packages migrate from security-testing to stable over two weeks.

## Why it matters
This bulletin highlights how a vulnerability in a ubiquitous Linux package manager can have amplified consequences in security-focused distributions that rely on template inheritance models. For Qubes administrators, the prescribed update ordering is critical: dom0 must be patched before any template updates occur, and direct apt invocation must be avoided to maintain the integrity guarantees of the Qubes update infrastructure. The incident also serves as a reminder that HTTPS-by-default configurations, while eliminating one attack class, do not protect against compromised mirrors or certificate authority breaches.