Debian's apt lets a man-in-the-middle swap verified packages and run code as root
Debian apt security update: man-in-the-middle arbitrary code execution
Debian Security Advisory DSA-6607-1 covers CVE-2026-109518, found by Max Justicz in the apt package manager. When an HTTP redirect gives two different package downloads the same URI, apt can merge them, and improper file handling during download resume lets a man-in-the-middle attacker replace a package after verification, executing arbitrary code as root. The fix lands in apt 3.0.4 for trixie and also patches several out-of-bounds access issues.
Improper file handling when resuming an HTTP download allows a man-in-the-middle attacker to replace a package after verification, resulting in the execution of arbitrary code as root.