Executive brief
Netatalk is an open-source implementation of the Apple Filing Protocol (AFP), allowing Unix-like systems to serve as file servers for macOS clients. A logic error in how the software handles new connection requests could allow a remote attacker to cause minor service disruptions. While the impact is considered low, it may result in unintended session behavior during the initial handshake process.
Technical details
A vulnerability exists in Netatalk's DSI (Data Stream Interface) OpenSession processing due to a missing break statement (CWE-484). Specifically, the DSIOPT_ATTNQUANT switch case falls through into the DSIOPT_SERVQUANT case. This logic error results in unintended session option handling. A remote, unauthenticated attacker can exploit this by sending specially crafted DSI session options over the network. While the vendor notes low practical exploitability and minimal security impact, it is technically capable of causing minor service instability. The issue is resolved in Netatalk version 4.5.0 or by applying a provided source patch.
Affected products
- Netatalk Netatalk 1.5.0 through 4.4.2
Timeline
- 2026-05-13: disclosed: Initial disclosure date by Netatalk team
- 2026-05-21: advisory: NVD publication date