The Debian project has released a security update to address a vulnerability in the 'apt' package manager, identified as CVE-2026-109518. The flaw stems from how 'apt' handles file merges during resumed HTTP downloads. Specifically, if an HTTP redirect causes two different package downloads to share the same Uniform Resource Identifier (URI), 'apt' can incorrectly merge these different downloads into a single file. This behavior creates a window of opportunity for a man-in-the-middle attacker to intervene in the download process.
An attacker exploiting this vulnerability could replace a legitimate package with a malicious one after the initial verification has occurred but before the download is complete. Because 'apt' may merge the malicious data into the existing file structure, the system could end up executing arbitrary code with root privileges. This risk is particularly relevant in environments where package delivery relies on standard HTTP rather than encrypted protocols, as the redirect mechanism can be manipulated by an entity positioned between the user and the server.
To mitigate this, Debian has released version 3.0.4 of the 'apt' package for the 'trixie' distribution, which corrects the merge logic and addresses several out-of-bounds access issues. While Debian's security policy typically focuses on backporting fixes to maintain the stability of existing releases, this update is critical for ensuring the integrity of the package installation process. Users are encouraged to upgrade their packages immediately. While automated tools like 'unattended-upgrades' can help maintain security, the vulnerability underscores the importance of verifying the integrity of the download path itself.