News › security
By The Linux Camp News, November 5, 2026
APT 3.0.4 fixes the flaw in Debian trixie. The official CVE record identifies HTTP manipulation, redirects and download retries as prerequisites, making APT configuration part of the exposure assessment.
Debian published DSA-6607-1 on November 4, 2026, fixing CVE-2026-109518 in its APT package manager. In the advisory retrieved November 5, Debian identifies APT 3.0.4 as the fixed version for stable, trixie. Debian says the flaw lets a man-in-the-middle attacker replace a package after verification and achieve arbitrary code execution as root. 2 1
The failure starts when an HTTP redirect gives two different package downloads the same URI, or resource address, allowing APT to merge them. Debian locates the defect in file handling when a download resumes; the official CVE record identifies reuse of hard links, which are filesystem names referring to the same underlying file. The important boundary is verification: the advisory describes replacement after that check, while the CVE record describes the installed replacement as unverified. Those accounts describe a download-handling failure, not a demonstrated defeat of the verification algorithm itself. 1 3
The official CVE record retrieved November 5 narrows the exposure conditions beyond Debian's short advisory. An on-path attacker must be able to manipulate HTTP traffic between APT and an archive server; a malicious mirror or proxy can fill that role. The client must follow redirects and retry package downloads, with Acquire::Retries set above zero. The record says a value of 3 became the default with Debian 12 and Ubuntu 22.04 LTS. Older releases are therefore unaffected in their default configuration, according to the record, rather than categorically unaffected under every configuration. 3
For operators, the useful checks are the installed APT package version and the effective Acquire::Retries setting. The latter matters because a nonzero value is an explicit attack prerequisite, not because the packet establishes a complete configuration-based workaround. Debian recommends upgrading APT packages and directs administrators to its security tracker for detailed package status. For trixie, 3.0.4 is the vendor-confirmed remediation target as of the November 5 retrieval; do not treat it as a universal version requirement for every Debian or Ubuntu release. 3 1
Severity and observed exploitation are separate questions. The official CVE record retrieved November 5 assigns CVSS 4.0 High severity, with a base score of 7.7. That score is not evidence of attacks. The CISA lookup retrieved the same day, using its November 4 catalog snapshot, does not list CVE-2026-109518. As the lookup explicitly cautions, absence from that catalog does not establish absence of exploitation. 3 4
Implementation details remain limited in this packet. Phoronix said the full report was not public when its November 4 article was written; that is a publication-time observation, not proof of its availability on November 5. The official CVE record adds the hard-link and retry prerequisites, but supplies no patch walkthrough. Its description concerns manipulated HTTP traffic and does not establish a blanket verdict for every HTTPS-only configuration. The evidence supports assessing the stated prerequisites, not declaring every APT installation exposed. 2 3