Debian APT Security Update Fixes CVE-2026-109518 in trixie

Debian published security advisory DSA-6607-1 for the apt package manager, covering CVE-2026-109518. Max Justicz discovered that APT can merge two different package downloads after an HTTP redirect gives them the same URI. Improper file handling when resuming an HTTP download can let a man-in-the-middle attacker replace a package after verification and execute arbitrary code as root.

Fix and affected releases

For the stable distribution, named trixie, the problem has been fixed in apt version 3.0.4. The security tracker also lists bookworm as fixed in apt 2.6.2 through the LTS advisory DLA-4880-1, and the unstable branch, sid, as fixed in version 3.3.6. The forky branch, at 3.3.5, is still marked vulnerable. The update also addresses several out-of-bounds access issues.

Recommended action

Debian recommends that users upgrade their apt packages. The advisory also points to the apt security tracker page for detailed security status, and to Debian security resources for more information about advisories, applying updates, and frequently asked questions.

Sources: Debian