Security vulnerability in APT allows execution of malicious code

dummy@example.com (jue-gen) — Thu, 05 Nov 2026 08:14:31 +0000

I’m not entirely confident in my English, so I have a question: Has a security update arrived in Devuan? How can I check this?

Package : apt
CVE ID : CVE-2026-109518

Max Justicz discovered a vulnerability in the APT package manager. APT
can merge two different package downloads after an HTTP redirect gives
them the same URI. Improper file handling when resuming an HTTP download
allows a man-in-the-middle attacker to replace a package after
verification, resulting in the execution of arbitrary code as root.

For the stable distribution (trixie), this problem has been fixed in
version 3.0.4. Additionally this update addresses several out-of-bounds
access issues.

We recommend that you upgrade your apt packages.

https://lists.debian.org/debian-securit … news.de%2F

Dev1 Galaxy Forum / Security vulnerability in APT allows execution of malicious code

Security vulnerability in APT allows execution of malicious code