Debian patches APT flaw letting network attacker run code as root
A flaw in APT, Debian's package manager, lets a network attacker tamper with a package after it passes verification and run code as root, through resumed HTTP downloads. The fix shipped in apt 3.0.4, in Debian 13 security updates on 4 November. No exploitation is reported in the sources; upgrade apt now.
What happened
Debian fixed a flaw in APT, the tool that installs software on the system. It let an attacker on the network tamper with a package after verification and run code as root, the highest privilege level. The fix shipped in apt 3.0.4, in Debian 13 security updates on 4 November.
Why it matters
Debian 13 machines downloading packages over HTTP could receive tampered software during install or update, with commands running as root. Servers and devices on corporate or hostile networks were exposed to full compromise.
What to do
Upgrade apt to version 3.0.4 now, via Debian 13 security updates. On untrusted networks, prefer HTTPS mirrors over HTTP repositories.
For the technical team
- CVE
- CVE-2026-109518
- Affected
- Debian APT (gerenciador de pacotes do Debian) · APT in resumed HTTP downloads; the advisory does not specify affected versions.
- Exploitation
- No public PoC or reported exploitation in the sources; disclosure only.
- Fix
- apt 3.0.4, shipped in Debian 13 security updates on 4 November. Per Debian's changelog, the fix is four words long: 'Open target files exclusively.'
- Vector
- APT, in resumed HTTP downloads. A redirect can give two different downloads the same address, and APT merges them. A man-in-the-middle on the network then alters the file after its check, leading to code execution as root.
- More details
- The flaw is CVE-2026-109518. Debian's changelog sums up the fix as opening target files exclusively.
Timeline
Initial disclosure: CVE-2026-109518 fixed in apt 3.0.4 for Debian 13.
Sources 1 source
- @IntCyberDigest @IntCyberDigest
