CVE-2026-44070: Netatalk unbounded realloc in charset conversion

CVE-2026-44070 · Severity: low · CVSS 3.1 · Published 2026-05-21

Netatalk is an open-source implementation of the Apple Filing Protocol (AFP), allowing Unix-like systems to serve as file servers for macOS clients. A flaw in how the software handles character set conversions could allow an authenticated user to trigger excessive memory consumption. While difficult to exploit in practice due to existing system limits, it could potentially lead to a denial-of-service condition where the server becomes unresponsive.

Quick answers

Is CVE-2026-44070 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-44070 being exploited in the wild.
How severe is CVE-2026-44070?
Low severity, with a CVSS score of 3.1, published 21 May 2026.
Which products and versions are affected?
Netatalk team Netatalk 2.0.0 through 4.4.2.
Is there a fix for CVE-2026-44070?
A patch was published on 2026-05-21: Fixed in version 4.5.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44070 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-44070?
Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A resource exhaustion vulnerability (CWE-770) exists in Netatalk's charset conversion logic. The software utilizes a retry loop that doubles the destination buffer size using 'realloc' without an explicit upper bound or overflow protection. An attacker with network access and valid credentials could attempt to trigger this loop to cause excessive memory allocation. However, exploitation is considered difficult (AC:H) because standard AFP path and string length limits typically constrain the growth before it reaches a critical level. The issue is resolved in version 4.5.0.

Affected products

  • Netatalk team Netatalk 2.0.0 through 4.4.2

Timeline

  • 2026-05-13: disclosed: Initial disclosure date
  • 2026-05-21: advisory: NVD publication date
  • 2026-05-21: patched: Fixed in version 4.5.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.