Executive brief
Netatalk is an open-source implementation of the Apple Filing Protocol (AFP) used to share files between Unix-like systems and Apple computers. A security flaw allows an authenticated user to predict session tokens, which can be used to disrupt the service. This could lead to a denial-of-service (DoS) condition where the file-sharing service becomes unavailable to users.
Technical details
Netatalk versions 2.0.0 through 4.4.2 suffer from a predictable session token vulnerability (CWE-330). The afpd session reconnect tokens are derived from the process ID (PID) rather than being cryptographically random. An authenticated attacker can enumerate these tokens and abuse the session reconnection path to terminate processes on the host. This results in a denial-of-service (DoS) condition. The issue is fixed in Netatalk version 4.4.3 or by applying a specific security patch.
Affected products
- Netatalk Netatalk 2.0.0 through 4.4.2
Timeline
- 2026-05-13: disclosed: Initial disclosure date reported by vendor
- 2026-05-21: advisory: NVD publication date
- 2026-05-21: patched: Fixed in version 4.4.3