Debian's apt lets a man-in-the-middle swap packages and run code as root
Debian apt security update (man-in-the-middle)
Debian Security Advisory DSA-6607-1 patches CVE-2026-109518 in apt, the package manager. Max Justicz found that when an HTTP redirect gives two downloads the same URI, apt can merge them, and improper file handling during download resumption lets a man-in-the-middle attacker replace a package after verification, executing arbitrary code as root. Fixed in apt 3.0.4 for trixie, along with several out-of-bounds access fixes.
Improper file handling when resuming an HTTP download allows a man-in-the-middle attacker to replace a package after verification, resulting in the execution of arbitrary code as root.