CVE-2026-44071: Netatalk disabled FORTIFY_SOURCE in MySQL CNID backend

CVE-2026-44071 · Severity: low · CVSS 3.7 · Published 2026-05-21

Netatalk, an open-source implementation of the Apple Filing Protocol (AFP) used for file sharing, was found to have been compiled without standard security hardening features in its MySQL backend component. This omission means that certain memory-related errors that would normally be caught and stopped by the system might instead lead to minor service disruptions. While the risk of a full system takeover is low, a remote attacker could potentially cause the file-sharing service to crash or become unavailable.

Technologies: Netatalk. Vendors: Netatalk.

Quick answers

Is CVE-2026-44071 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-44071 being exploited in the wild.
How severe is CVE-2026-44071?
Low severity, with a CVSS score of 3.7, published 21 May 2026.
Which products and versions are affected?
Netatalk 3.1.2 through 4.4.2.
Is there a fix for CVE-2026-44071?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-44071 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-44071?
Check whether you run Netatalk at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability stems from a protection mechanism failure (CWE-693) where the MySQL CNID source file explicitly disables FORTIFY_SOURCE during compilation. This removes runtime buffer overflow detection and hardening for that specific module. A remote attacker could potentially exploit memory errors that would otherwise be safely terminated by the compiler's runtime protection, leading to a minor denial of service (DoS). The issue is specific to the MySQL CNID backend and is considered to have low practical exploitability. Users are advised to upgrade to Netatalk 4.5.0 or apply the provided patch to version 4.4.2.

Affected products

  • Netatalk Netatalk 3.1.2 through 4.4.2

Timeline

  • 2026-05-13: disclosed
  • 2026-05-21: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.