Debian testing and Unbuntu has an apt vulnerability

Debian
1

So I was checking my email and found a post from Reddit that caught my eye apt vulnerability.
I followed the link to the original story (the link I posted) and it turns out that apt 3.3.5 allows apt to follow malicious links after the initial package update is activated.

The short version is apt 3.3.6 is the fix and is recommended to be installed ASAP.

5 Likes
2

Thanks for sharing this; I saw this yesterday; I didn’t see any Debian updates catching it today, but MAYBE I already have the fix; I’ll double check my apt software to make sure that I have apt 3.3.6 installed!

I just read this: CVE‑2026‑109518 is a critical man‑in‑the‑middle vulnerability in Debian’s APT that allows attackers to replace verified packages during resumed HTTP downloads and execute arbitrary code as root; Debian fixed it in APT versions 3.0.4 (trixie) and 2.6.2 (bookworm).

I have APT version 3.0.4, so I’m okay.

4 Likes
3

version check: CVE-2026-109518 | Ubuntu
Apt is fixed in all releases.

Ubuntu 24.04 → todays security update contains the fix
Ubuntu 26.10 → todays security update contains the fix

5 Likes
4

Got the update early this morning on my Debian Trixie (v3.0.4) .

2 Likes