Debian published security advisory DSA-6607-1 on 4 November for a flaw in the APT package manager, CVE-2026-109518, that lets a man-in-the-middle attacker replace a package after verification and run code as root.
The advisory credits Max Justicz and says APT “can merge two different package downloads after an HTTP redirect gives them the same URI.” The Debian security tracker adds the conditions: the attacker is an on-path party, including “a malicious mirror or proxy,” between the APT client and the archive server, and the attack runs during a package install. It also “requires the client to have a non-zero Acquire::Retries configuration setting,” and the tracker notes that the value 3 has been the default since Debian 12 (bookworm) and Ubuntu 22.04 LTS, so older releases are unaffected in a default configuration.
The tracker lists fixed versions: 2.6.2 for bookworm in the security archive, 3.0.4 for trixie through DSA-6607-1, and 3.3.6 for forky and sid. The unfixed versions it names are 2.6.1 for bookworm and 3.0.3 for trixie. The DSA adds that the trixie update “addresses several out-of-bounds access issues” as well.
Anyone who manages Debian or Ubuntu fleets should treat the retry setting as a second variable. Older releases can still be exposed if a script or configuration management tool sets a retry count, so a search of /etc/apt/apt.conf.d and of provisioning code is a fast check. Pointing hosts at a mirror that the organization controls narrows the on-path position the flaw needs.
In our reading, build images and CI runners deserve the first look, because they install packages often and rarely get a human review of their configuration. We covered another Linux distribution advisory when Ubuntu listed a kernel flaw as high with fixes in progress, and a related lesson on checking that a fix worked when Alpine said upgrading GitLab did not fix a flaw on its instance.
