# CVE-2026-44075: Netatalk missing break statement in DSI OpenSession

Source: https://junglewise.ai/threats/cve-2026-44075-netatalk-missing-break-statement-in-dsi-opensession  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-21. Updated: 2026-05-21  
License: CC BY 4.0 with a link back

CVE-2026-44075 · Severity: low · CVSS 3.7 · Published 2026-05-21

Netatalk is an open-source implementation of the Apple Filing Protocol (AFP), allowing Unix-like systems to serve as file servers for macOS clients. A logic error in how the software handles new connection requests could allow a remote attacker to cause minor service disruptions. While the impact is considered low, it may result in unintended session behavior during the initial handshake process.

Technologies: [Netatalk](https://junglewise.ai/threats/technologies/netatalk). Vendors: [Netatalk](https://junglewise.ai/threats/vendors/netatalk).

## Quick answers

**Is CVE-2026-44075 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44075 being exploited in the wild.

**How severe is CVE-2026-44075?** Low severity, with a CVSS score of 3.7, published 21 May 2026.

**Which products and versions are affected?** Netatalk 1.5.0 through 4.4.2.

**Is there a fix for CVE-2026-44075?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-44075 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-44075?** Check whether you run Netatalk at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in Netatalk's DSI (Data Stream Interface) OpenSession processing due to a missing break statement (CWE-484). Specifically, the DSIOPT_ATTNQUANT switch case falls through into the DSIOPT_SERVQUANT case. This logic error results in unintended session option handling. A remote, unauthenticated attacker can exploit this by sending specially crafted DSI session options over the network. While the vendor notes low practical exploitability and minimal security impact, it is technically capable of causing minor service instability. The issue is resolved in Netatalk version 4.5.0 or by applying a provided source patch.

## Affected products

- Netatalk Netatalk 1.5.0 through 4.4.2

## Timeline

- 2026-05-13: disclosed: Initial disclosure date by Netatalk team
- 2026-05-21: advisory: NVD publication date

## References

- [https://netatalk.io/security/CVE-2026-44075](https://netatalk.io/security/CVE-2026-44075)

## Related threats

- [Netatalk afpd stack buffer overflow in deletedir()](https://junglewise.ai/threats/cve-2026-45698-netatalk-afpd-stack-buffer-overflow-in-deletedir)
- [Netatalk afpd stack buffer overflow in copydir()](https://junglewise.ai/threats/cve-2026-45699-netatalk-afpd-stack-buffer-overflow-in-copydir)
- [Netatalk TOCTOU race condition in ad_flush](https://junglewise.ai/threats/cve-2026-7837-netatalk-toctou-race-condition-in-ad-flush)
- [Netatalk incorrect calculation in ACL error handling](https://junglewise.ai/threats/cve-2026-44074-netatalk-incorrect-calculation-in-acl-error-handling)
- [Netatalk disabled FORTIFY_SOURCE in MySQL CNID backend](https://junglewise.ai/threats/cve-2026-44071-netatalk-disabled-fortify-source-in-mysql-cnid-backend)