Netatalk CVE-2026-44068

Vendor-released patch: Netatalk 4.4.3 - upgrade all Netatalk installations to 4.4.3 or later as referenced in the advisory at https://netatalk.io/security/CVE-2026-44068. NAS appliance operators should track the vendor firmware update channel for a backport, since embedded builds typically lag upstream. Where immediate patching is not possible, compensating controls include disabling the AFP service entirely on hosts that can migrate clients to SMB (afpd off in netatalk.conf or systemctl disable netatalk; side effect: Time Machine over AFP and legacy macOS clients will stop working), restricting AFP TCP port 548 at the network edge and host firewall to known macOS endpoints (side effect: breaks roaming/VPN clients), and tightening per-share user mapping to remove guest and low-privilege accounts so the PR:L precondition cannot be met (side effect: existing low-privileged users lose AFP access). Disabling extended-attribute / Spotlight/EA support per share in AppleVolumes.default (ea:none) may reduce the attack surface for the specific ea code path but breaks resource-fork and metadata fidelity for macOS clients.