Debian APT vulnerability could enable root-level code execution
Technology · First reported 4 Nov, 12:46 · Updated 13:07
A Debian security advisory describes an APT vulnerability in which a man-in-the-middle attacker could replace a package after verification and execute code as root. The advisory says the issue is fixed in APT 3.0.4 for Debian stable (trixie) and recommends upgrading APT packages.
- The reported flaw involves improper handling when resuming an HTTP download; the advisory says redirected downloads can be merged, allowing a package to be replaced after verification.
- The reported outcome is arbitrary code execution with root privileges by a man-in-the-middle attacker.
- The advisory says Debian stable (trixie) is fixed in APT version 3.0.4 and recommends upgrading APT packages.
Summary written by Lux AI from 2 articles
Key facts
- Vulnerability identifier
- CVE-2026-109518
- Affected software
- Debian APT package manager
- Stated fixed version
- APT 3.0.4 for Debian stable (trixie)
- Attack outcome
- Arbitrary code execution as root
Source spectrum
Left 0 · Centre 0 · Right 0 of 0 rated sources · +2 unrated
All coverage
Coverage over time
LeftCentreRight
Articles per hour since first reported, by side.
Ownership
- Unknown 100% (2)
Share of the 2 sources by owner type.