# Debian fixes APT flaw allowing package replacement after verification

_Published Wednesday, November 4, 2026 at 8:42 AM EST · Security, Infrastructure · Latest · Tier 2 — Notable_

Debian released APT 3.0.4 for its stable trixie distribution to fix a vulnerability that can let a man-in-the-middle attacker execute arbitrary code as root. The flaw, CVE-2026-109518, affects how the package manager resumes HTTP downloads.

APT can merge two package downloads when an HTTP redirect gives them the same URI. Improper file handling then allows an attacker to replace a package after verification. The update also addresses several out-of-bounds access issues, and Debian recommends upgrading APT packages.

## Sources

- [lists.debian.org](https://lists.debian.org/debian-security-announce/2026/msg00526.html)

---
Canonical: https://techandbusiness.org/newswire/k50q30l_SlNDd1zKOad-qX
Published: 2026-11-04T13:42:41.902Z
Story chronology: 2026-11-04T12:46:58.000Z
Retrieved: 2026-11-04T22:05:46.184Z
Publisher: Tech & Business (techandbusiness.org)