Debian issued an APT security update on November 4, 2026 for a package-verification bypass that can let a network attacker get code executed as root. The DSA-6607-1 advisory identifies CVE-2026-109518 and fixes it in APT 3.0.4 for the stable trixie distribution. It credits researcher Max Justicz with discovering the flaw.
The attack targets how APT handles downloads after verification. Administrators need to check the package manager's own version, alongside the packages it installs. Neither the advisory nor the maintainer's technical notice reports exploitation in the wild.
Redirects and retries create the opening
Debian says APT can merge two package downloads when an HTTP redirect gives them the same URI. Incorrect file handling while resuming a download then lets a man-in-the-middle attacker replace a package after it has been verified, with root-level code execution as the consequence.
APT maintainer Julian Andres Klode's technical notice adds a condition useful for assessing exposure: the attack relies on the Acquire::Retries setting being enabled. He says this has been the default since APT 2.3.2, while scripts may have enabled it on older releases too. The described sequence combines redirects with transient HTTP server errors that trigger download retries, causing existing hardlinks to be overwritten with an attacker's payload.
That condition limits the described attack path. An older version number alone doesn't establish that retries were disabled on a particular machine. The published notices describe the vulnerability; MrKeyoor has not reproduced an exploit.
Match the fix to your Debian release
The Debian security tracker lists trixie's 3.0.3 as vulnerable and its security update 3.0.4 as fixed. For bookworm, it lists 2.6.1 as vulnerable and 2.6.2 as fixed. A fleet check therefore needs the distribution and package version together, rather than treating 3.0.4 as the minimum for every supported branch.
The maintainer notice says updates are being released through Debian and Ubuntu support channels, including their extended-support offerings. Watch the relevant distribution's advisory and package status for confirmation that the corrected build has reached each system. Debian's recommendation is to upgrade APT; the existence of an upstream fix does not establish that an individual host has installed it.