Debian’s security advisory DSA-6607-1, dated 4 November 2026, fixes CVE-2026-109518 in apt itself. Max Justicz found it. That is the story: apt installs every other fix, so the upgrade that closes this hole is the one you cannot put off.

What the flaw does

“APT can merge two different package downloads after an HTTP redirect gives them the same URI.” From there, the advisory says, “Improper file handling when resuming an HTTP download allows a man-in-the-middle attacker to replace a package after verification, resulting in the execution of arbitrary code as root.”

Read “after verification” closely, because that is the part people get wrong. Apt’s signature checking is not described as broken here. The package is checked and then swapped, which is worse in a way that is easy to miss: a system that trusts its verification steps has no way to notice from the outside.

What the advisory leaves out

It gives no severity score, and Debian’s tracker gives none either, so no CVSS figure appears here. The attacker is named as a man-in-the-middle and nothing more specific, and the advisory does not explain how the two downloads come to share a URI beyond the redirect itself. No write-up by Justicz was collected, so this description stops where the advisory’s does rather than filling the gap from inference.

Nothing collected says the flaw has been exploited. The action is the same either way.

Which suites are fixed

Debian’s tracker is the version authority here. For trixie it lists 3.0.3 as vulnerable and 3.0.4 as fixed in the security suite, which matches the advisory: “For the stable distribution (trixie), this problem has been fixed in version 3.0.4.”

For bookworm it lists 2.6.1 as vulnerable and 2.6.2 as fixed, and attributes that fixed version to DLA-4880-1 rather than to this DSA, which is worth noticing if you follow the LTS advisory stream instead. For forky and sid the package table lists 3.3.5 as vulnerable together, while the tracker’s separate fixed-versions table lists 3.3.6 for unstable and no fixed version for forky. Both rows are worth reading as the tracker leaves them, not resolved into one prediction.

What to do

The advisory’s own instruction is short: “We recommend that you upgrade your apt packages.” Take that as the order of operations rather than one item in a list. Upgrade apt first, then let it handle the rest of the queue, and note that this same update “addresses several out-of-bounds access issues” in apt as well.

There is an awkward consequence in the failure mode itself. The advisory’s attacker sits between your machine and an archive server, so the upgrade is only as trustworthy as the path it takes. If a mirror or a proxy on that path is not yours, doing this one upgrade over a connection you trust is a small precaution that costs nothing and matches what the advisory describes. After that, treat the fixed versions above as the check that it worked.

Sources: DSA-6607-1 and Debian’s security tracker entry for CVE-2026-109518.