Debian patches apt RCE that let MITM swap verified packages
A man-in-the-middle attacker could replace a package after verification and run code as root when HTTP retries were enabled.
Debian has issued a security update for a remote code execution flaw in the APT package manager that allowed a man-in-the-middle attacker to replace a package after it had already been verified, leading to arbitrary code execution as root.
CVE-2026-109518 covers a failure in how APT handled resumed HTTP downloads after a redirect: two different package downloads could be merged when a redirect gave them the same URI, so an attacker in a position to interfere with the connection could substitute malicious content for a package the user believed was authentic. Max Justicz discovered the issue. The problem depends on the Acquire::Retries setting, which has been the default since APT 2.3.2 and is also common in user scripts on older releases.
The stable distribution (trixie) is fixed in APT 3.0.4. The same update also closes several out-of-bounds memory access issues. Until systems are upgraded, setting Acquire::Retries to 0 in apt configuration can reduce exposure. APT is the default package manager on Debian and many derivatives, so a flaw that turns a network attacker into root on package install is high impact for anyone fetching packages over untrusted paths.