Netatalk CVE-2026-44067

Upgrade Netatalk to version 4.5.0, the vendor-released patch that resolves the EA header heap over-read; this is confirmed by both the CVE description and the vendor advisory at https://netatalk.io/security/CVE-2026-44067. If an immediate upgrade is not operationally feasible, apply the following specific compensating controls with noted trade-offs: restrict access to AFP port 548 via host-based or network firewall rules to limit exposure to trusted networks only (trade-off: disrupts legitimate remote AFP clients outside the allowed range); enforce strong authentication and limit AFP user accounts to the minimum required set, reducing the pool of potential authenticated attackers (trade-off: administrative overhead); and consider disabling extended attribute support in Netatalk configuration if EA functionality is not operationally required (trade-off: may break resource fork or Finder metadata handling for macOS clients). None of these compensating controls eliminate the vulnerability - they reduce attack surface while a patch cycle is completed.