Debian APT flaw CVE-2026-109518 lets attackers hijack updates and run code as root
VULNERABILITYCVE-2026-109518redteam/daily · 1 source
- Severity
- High
- Highest CVSS
- 7.7
- Exploited
- Not known
- Sources
- 1
What happened
CVE-2026-109518 in APT (disclosed by Debian on 4 November 2026, credited to Max Justicz) allows a MITM or rogue mirror to bypass signed-package verification. Exploitation abuses HTTP redirect handling, resumed-download file handling and hard link reuse, with a race window after verification, leading to root code execution. Affected per the Debian Security Tracker: bookworm 2.6.1 (fixed 2.6.2, DLA-4880-1), trixie 3.0.3 (fixed 3.0.4, DSA-6607-1), testing/unstable 3.3.5 (upstream fix 3.3.6). Patch now, and set Acquire::Retries to 0 as a temporary mitigation on unpatched hosts.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Upgrade APT to 2.6.2 on bookworm or 3.0.4 on trixie, and check that the installed version matches the fixed one for your release.
- Run apt update and apt upgrade only on trusted networks.
- Avoid untrusted mirrors and proxies until your system is patched.
- On unpatched systems, consider setting Acquire::Retries to 0, though this can make updates less reliable on poor connections.
Written by AI from the sources, checked against them
Vulnerabilities
Full story timeline · 2 updates
Who reported · 1 outlet
Cyber Security News