| Package | apt |
|---|---|
| Version | 1.4.12 (stretch), 1.8.2.4 (buster), 2.2.5 (bullseye) |
| Related CVEs | CVE-2026-109518 |
Max Justicz discovered a vulnerability in the APT package manager. APT can merge two different package downloads after an HTTP redirect gives them the same URI. Improper file handling when resuming an HTTP download allows a man-in-the-middle attacker to replace a package after verification, resulting in the execution of arbitrary code as root.
For Debian 10 buster, these problems have been fixed in version 1.8.2.4.
For Debian 11 bullseye, these problems have been fixed in version 2.2.5.
For Debian 9 stretch, these problems have been fixed in version 1.4.12.
We recommend that you upgrade your apt packages.
Further information about Extended LTS security advisories can be found in the dedicated section of our website.