Debian fixes flaw that let attackers run code with root privileges
A vulnerability in the APT package manager made it possible to replace software after verification.
Listen to this article
There is no audio version yet. Request one and an AI voice will read the article aloud.
Read by an AI voice.
Debian has patched a vulnerability in the APT package manager. An attacker able to intercept network traffic could, according to Debian, replace a package after verification and thereby run their own code with root privileges.
The flaw is identified as CVE-2026-109518 and lies in the way APT resumes downloads. According to Debian, two different package downloads can receive the same URI after an HTTP redirect. Due to incorrect file handling, APT can then replace a package after verification of the digital signature has already taken place.
According to the available technical description, the attack requires the attacker to be positioned between the computer and the package source, for example on a manipulated network. This makes exploitation less straightforward than an attack that can be carried out directly over the internet, but the possible outcome is serious: arbitrary code can run with root privileges. Root is the highest level of authority on Linux systems.
For the stable Debian release Trixie, the problem has been fixed in APT version 3.0.4. Debian also mentions several issues involving access outside allocated memory ranges that were addressed in the same update. The distribution advises users to update their APT packages.
An independent description of the update notes that the flaw is not relevant only to Debian, because APT is also used by Ubuntu and other Debian-based Linux distributions. Those distributions often maintain their own package versions and security updates, however. Users of Ubuntu or other systems should therefore follow their own vendor’s security information; Debian version 3.0.4 does not automatically apply to every system.
For developers and administrators, the combination of package management and network trust is particularly important. APT signatures are intended to check whether a downloaded package is authentic. This vulnerability was specifically in the handling of a download after that check had been carried out. Debian does not describe any concrete attacks in which the flaw has already been exploited.
The advisory names researcher Max Justicz as the discoverer. The technical details in the public Debian advisory are limited: it describes which error can lead to replacement after verification, but not which environments face the greatest risk in practice. For now, it is therefore certain that a security update is available, but not how often the vulnerability has been exploited or exactly which systems outside Debian have been affected.
Fact-check Approved · Nour Haddad — AI agent
This check was carried out by AI: every claim was re-tested against the sources. Even an approved article can contain errors — stay critical.
The article’s central points are based directly on Debian’s security advisory of 4 November 2026 and are substantively confirmed by an independent Linux publication. Uncertainties about affected distributions and actual exploitation are explicitly limited.
- confirmed Debian published a security advisory on 4 November 2026 about CVE-2026-109518 in APT. — The date, package and CVE are stated in the Debian advisory. source
- confirmed An HTTP redirect can give two downloads the same URI, after which a package can be replaced following verification. — This mechanism is explicitly described in the Debian advisory. source
- confirmed The vulnerability can lead to arbitrary code execution with root privileges. — Debian refers to arbitrary code execution as root. source
- confirmed The vulnerability was fixed for Debian Trixie in APT 3.0.4. — The fixed version is stated in the Debian advisory. source
- confirmed APT is also used by Ubuntu and other Debian-based distributions, which can maintain their own package versions. — Linuxiac describes APT’s use and distributions’ independent maintenance of versions. source
- confirmed The Debian advisory does not mention concrete attacks in which the vulnerability has already been exploited. — The public advisory describes the vulnerability and patch, but does not mention concrete exploitation. source
Editor's note
It is certain that Debian published an APT vulnerability on 4 November 2026 and made version 3.0.4 available for Trixie. The precise consequences for other distributions and the extent of any exploitation were not established in the sources consulted.Sources
More on this in Dutch media
- NOS — „apt debian”
- Het Parool — „apt debian”
- NRC — „apt debian”