The bouncer checks your ID, then someone swaps your coat after you pass
CVE-2026-109518 is a flaw in APT's HTTP download resume/redirect logic. When APT follows an HTTP redirect and two different package downloads end up with the same URI, its resumption handling can merge or append content from one download into another. An attacker who can influence the network path can replace a .deb file after APT has already verified its integrity. The substituted package is then installed by APT with root privileges, executing arbitrary code as root. Affected version ranges: Debian trixie ships a vulnerable APT before 3.0.4; upstream APT before 3.3.6 is affected.
Debian does not assign a CVSS score in DSA-6607-1, so this is an initial assessment, not a comparison. The impact is severe—root-level arbitrary code execution from the package manager—but the attack surface is narrowed by the hard requirement of a man-in-the-middle position. The vendor advisory's qualitative impact is consistent with a HIGH rating when considering practical exploit preconditions and the ubiquity of APT across Debian systems.
4 steps from start to impact.
Gain a privileged network position between the APT client and an HTTP repository
bettercap, ettercap, or a compromised router/switch can provide this position. APT often uses plain HTTP by default on Debian systems, making interception straightforward once the attacker has network influence.- Ability to intercept or redirect HTTP traffic between the target host and its APT mirror
- Requires a network-level attacker, not a remote unauthenticated attacker
- Many enterprise environments use internal package mirrors or network segmentation that limits passive interception
Wait for or trigger a resumable HTTP package download and redirect two different downloads to the same URI
- Target uses HTTP APT source
- The package download is resumable or partial under APT's HTTP implementation
- Attacker can control redirect responses
- Many package downloads are small and one-shot, so the vulnerable resumption path may not trigger on every update
- Attacker must maintain precise redirect control during the window when APT downloads the target package
Exploit improper file handling to replace the verified .deb file
- Vulnerable APT version running on the target
- Attacker has injected package content into the merged download
- Requires careful timing and size alignment between the original and malicious package payloads
- The flaw is in the resume/redirect logic, not a simple write primitive; exploit reliability may be lower than a direct command injection
Execute the attacker-controlled package as root
apt install or unattended upgrade installs it with root privileges. Maintainer scripts inside the package run as root, giving the attacker arbitrary code execution on the target host.- User or unattended-upgrades triggers apt install/upgrade on the tampered package
- Not every host automatically installs updated packages immediately
- If the attacker replaced a package that is not scheduled for installation, they must wait or manipulate the update process
apt-get update && apt-get install apt; for other distributions, pull the vendor backport. For HIGH severity, the noisgate mitigation SLA says deploy within 30 days; the noisgate remediation SLA says patch within 180 days. Because this is a package-manager root RCE, patch as soon as possible.https://deb.debian.org or a local signed mirror. This makes the redirect/merge attack far harder because MITM cannot forge TLS without a valid certificate. With only this control applied, the attack path is broken at step 1 for passive MITM but still possible with TLS interception. Deploy within 30 days as a temporary mitigation./var/cache/apt/archives can detect post-verification replacement during the residual window. This control alone reduces exposure but does not eliminate the vulnerability on hosts that do not run unattended-upgrades or where monitoring is after the fact.- GPG signature verification alone: the vulnerability replaces the file after apt has already verified it.
- EDR/AV on the host: the payload runs as root from a trusted package-manager process; prevention before root is unreliable.
- Network WAF/IPS: plain HTTP apt traffic is normal and the tampering occurs within an otherwise legitimate session.
The supporting signals.
| In-the-wild status | No known active exploitation or mass campaigns as of 2026-11-04 |
|---|---|
| Proof-of-concept availability | No credible public PoC confirmed. A Sploitus entry for CVE-2026-109518 appears to conflate PHP-engine CVEs (CVE-2026-109618/109619) and is not apt-related. |
| EPSS score/percentile | Not found in FIRST EPSS dataset at time of assessment; predicted exploit probability is low due to MITM requirement. |
| KEV status/date | Not listed in CISA KEV as of 2026-11-04. |
| CVSS vector | No CNA/ADP vector published by Debian. Upstream DSA-6607-1 provides qualitative impact only: full root compromise via MITM. |
| Affected versions | Debian trixie apt before 3.0.4; upstream apt before 3.3.6 |
| Fixed versions | Debian trixie apt 3.0.4; upstream apt 3.3.6. Check Debian security tracker for backports to older releases. |
| Scanning/exposure | Network scanners cannot identify MITM exposure. Enumerate apt versions via dpkg -s apt on all Debian/Ubuntu hosts. Internet-facing APT clients are rare; internal mirror usage is common. |
| Disclosure date | 2026-11-04 (DSA-6607-1 published) |
| Reporting researcher/org | Max Justicz |
Sources.
Why this verdict
- No vendor baseline — Debian DSA-6607-1 does not assign a CVSS, so this is an initial assessment, not an upgrade/downgrade.
- Impact is root RCE — the substituted package runs with superuser privileges; no interaction beyond a normal apt install/upgrade is needed.
- MITM precondition limits reach — attacker must already intercept or redirect HTTP package traffic; not a remote unauthenticated vector, but typical Debian repos use plain HTTP and package signatures are bypassed after verification.
- Role multiplier: APT is ubiquitous — installed on workstations, servers, CI runners, backup hosts, and any Debian-based high-value system; a successful MITM against a CI/CD or backup server can lead to fleet/credential compromise.
Why not higher?
We stop at HIGH rather than CRITICAL because the attack requires a pre-existing network interception position, does not self-propagate, and no active exploitation or working public exploit is confirmed. The highest-value targets would also need an attacker already resident on a segment that can influence apt downloads, further narrowing the exposed population.
Why not lower?
We cannot go below HIGH because success yields immediate root on any Debian host, APT runs as root by design, and high-value Debian deployments (>1% of install base) could turn into domain/credential pivots. The fix is a package-manager update, so residual risk until patched is substantial.
Crowdsourced verification payload.
Run on each Debian/apt-based host. Example: bash check_apt_cve-2026-109518.sh as any user with dpkg access (root not required). Outputs VULNERABLE / PATCHED / UNKNOWN.
#!/bin/bash
# Verify apt version for CVE-2026-109518 (DSA-6607-1)
# Fixed in Debian trixie: >= 3.0.4; upstream: >= 3.3.6
set -uo pipefail
pkg_version="$(dpkg-query -W -f='${Version}' apt 2>/dev/null || true)"
if [ -z "$pkg_version" ]; then
echo "UNKNOWN: apt package not found"
exit 2
fi
if dpkg --compare-versions "$pkg_version" ge "3.0.4"; then
echo "PATCHED: apt version $pkg_version >= 3.0.4"
exit 0
else
echo "VULNERABLE: apt version $pkg_version is below fixed version 3.0.4/3.3.6"
exit 1
fi