APT, the package manager used by Debian, Ubuntu, and other Debian-based Linux distributions to install, update, and remove software, has been updated to version 3.3.6.
The most important change is a fix for CVE-2026-109518, a download verification bypass vulnerability. According to the changelog, the issue has been addressed by modifying APT’s download methods to open target files exclusively, preventing conflicting access during the download process.
In addition, APT 3.3.6 resolves two potential out-of-bounds access issues. The first affects the DEB package parser, which now rejects packages missing the mandatory Version field. The second concerns the dependency solver. The workLess comparator has been corrected to guarantee strict weak ordering, a requirement for reliable sorting operations.
The release also introduces several improvements to APT’s performance evaluation tools. These include proper scaling of multiplexed hardware performance counters, setting the CLOEXEC flag on performance monitoring and output file descriptors, and avoiding unintended copying of performance context objects.
On the testing side, APT 3.3.6 expands its automated test coverage with support for Hegel, a property-based testing framework. New tests cover Debian version comparisons, dependency solver behavior, package metadata parsing, and round-trip operations involving string utilities. Additional unit tests check quoted-word parsing and Base64 whitespace handling.
For additional details, refer to the APT package tracker.
APT 3.3.6 is currently available in Debian Unstable (Sid). Users running Debian Stable or Ubuntu should not expect this version to appear in their regular repositories, as these distros generally maintain their own APT versions rather than adopting new upstream releases.
