The Debian security team has issued an advisory (DSA-6607-1) regarding a critical vulnerability in the APT package manager, the primary tool used to install and manage software on Debian-based systems. The flaw, identified as CVE-2026-109518, allows a man-in-the-middle (MITM) attacker to execute arbitrary code with root privileges. This occurs because APT can be tricked into merging two different package downloads if an HTTP redirect causes them to share the same Uniform Resource Identifier (URI). When combined with improper file handling during the resumption of an HTTP download, an attacker can replace a legitimate package with a malicious one after the initial verification has occurred.
The technical mechanism relies on the way APT handles fragmented downloads over unencrypted connections. Because the transport layer is not encrypted, a MITM attacker can observe the traffic and manipulate the redirection process. By ensuring that a malicious file is associated with a URI that APT expects to be a legitimate package, the attacker can bypass the integrity checks that would normally occur during a standard download. This specific vulnerability highlights a significant risk in systems that rely on plain HTTP for package distribution, as the lack of transport-layer encryption allows for the manipulation of the download flow before the final file is assembled.
Debian has addressed this issue by releasing version 3.0.4 for the stable distribution (trixie). The update also resolves several out-of-bounds access issues. While the Debian project has long maintained that PGP signatures provide sufficient integrity for packages, this vulnerability serves as a practical example of the risks associated with using unencrypted HTTP. Relying solely on signatures means that while the final file's authenticity can be checked, the process of fetching and merging those files remains exposed to interception. Users are strongly encouraged to upgrade their APT packages immediately to mitigate the risk of unauthorized code execution.