Executive brief
Netatalk is an open-source implementation of the Apple Filing Protocol (AFP), which allows Unix-like systems to serve as file servers for macOS clients. A flaw in how the software handles incoming data requests allows an unauthenticated attacker to overwhelm the server, leading to a denial of service. This can disrupt file-sharing operations and prevent legitimate users from accessing stored data.
Technical details
An integer underflow vulnerability exists in the dsi_writeinit() function within Netatalk's Data Stream Interface (DSI) handling. The flaw is caused by a missing bounds check that leads to a miscalculation of incoming payload sizes. An unauthenticated remote attacker can exploit this by sending specially crafted packets, forcing the 'afpd' process to spend excessive time receiving data, effectively causing a denial of service. While the issue does not lead to memory corruption or remote code execution, it can be triggered in pre-authentication protocol states. The vulnerability is fixed in version 4.4.3.
Affected products
- Netatalk Netatalk 1.5.0 through 4.4.2
Timeline
- 2026-05-13: disclosed: Initial disclosure date reported by vendor
- 2026-05-21: advisory: NVD publication date
- 2026-05-21: patched: Version 4.4.3 released with fix