Gistline
Get GistlineGet
Menu
Debian apt security update fixes man-in-the-middle flaw
x.com

Debian apt security update fixes man-in-the-middle flaw

The gist

Debian released APT 3.0.4 for Debian 13 and 2.6.2 for Debian 12 to fix CVE-2026-109518.
The bug lets a man-in-the-middle swap a verified package and run code as root.

How it unfolded

  1. Nov 4, 2026Max Justicz discloses CVE-2026-109518, a package-verification bypass in APT that can let a man-in-the-middle attacker replace a verified package and execute arbitrary code as root.
  2. Nov 4, 2026Debian issues advisory DSA-6607-1 explaining the HTTP redirect and download-resume flaw and recommending an APT upgrade.
  3. Nov 4, 2026Debian releases APT 3.0.4 for Debian 13 (trixie) and 2.6.2 for Debian 12 (bookworm), also fixing several out-of-bounds memory bugs; upstream APT 3.3.6 enters Debian unstable the same day.

Sources

Read the full story in the app Gistline — free on the App Store