EUVD-2026-31247
GHSA-2pwf-3x8m-5x9q
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Primary rating from Vendor (securin) · only source for this CVE.
CVSS VectorVendor: securin
Lifecycle Timeline
1DescriptionCVE.org
Netatalk 2.1.0 through 4.4.2 combines multiple errno values using bitwise OR, resulting in incorrect error codes when multiple error conditions occur simultaneously, which may allow a remote attacker to cause a minor service disruption via conditions that trigger incorrect error-handling paths.
AnalysisAI
Incorrect errno calculation in Netatalk 2.1.0 through 4.4.2 allows remote unauthenticated attackers to cause minor service disruption by triggering simultaneous error conditions that produce invalid composite error codes via bitwise OR misuse. The flaw (CWE-682, Incorrect Calculation) diverts execution into incorrect error-handling paths within the AFP file-sharing service, affecting availability at a low level (A:L) with no confidentiality or integrity impact. No public exploit or active exploitation has been identified at time of analysis; the CVSS score of 3.7 (Low) and high attack complexity (AC:H) reflect a limited real-world threat.
Technical ContextAI
Netatalk is a widely deployed open-source implementation of the Apple Filing Protocol (AFP), enabling file-sharing between Unix/Linux servers and Apple macOS clients. The root cause is CWE-682 (Incorrect Calculation): the codebase erroneously combines multiple POSIX errno values using the bitwise OR operator when multiple error conditions occur simultaneously. In C/Unix programming, errno values are small distinct integers representing specific error states; ORing them together yields a nonsensical composite integer that does not map to any valid error code, causing the runtime to select an unintended error-handling branch. This is a coding logic error in the error-propagation layer of the application rather than a memory corruption or authentication bypass. The CPE identifier cpe:2.3:a:netatalk:netatalk:*:*:*:*:*:*:*:* spans the full Netatalk application suite across the affected version range.
RemediationAI
Consult the vendor security advisory at https://netatalk.io/security/CVE-2026-44074 for the official patch and confirmed fix version - a specific patched release number was not independently verifiable from the provided source data, so the advisory should be treated as the authoritative source. Organizations running Netatalk 2.1.0 through 4.4.2 should plan to upgrade to the vendor-confirmed fixed version; given the low CVSS score and high attack complexity, this does not warrant emergency patching in most environments. As a compensating control, restricting network access to the AFP service port (typically TCP 548) to trusted subnets or VLANs reduces the network attack surface, with the trade-off of limiting remote Apple client connectivity. If AFP is not required for a given host, disabling the Netatalk service entirely eliminates exposure with no functional side effects for non-AFP workloads.
Netatalk before 3.1.12 is vulnerable to an out of bounds write in dsi_opensess.c. Rated critical severity (CVSS 9.8), th
Netatalk through 3.1.13 has an afp_getappl heap-based buffer overflow resulting in code execution via a crafted .appl fi
Heap buffer overflow in the Netatalk cnid_metad daemon's comm_rcv() function allows remote attackers with low-level priv
A Type Confusion vulnerability was found in the Spotlight RPC functions in afpd in Netatalk 3.1.x before 3.1.17. Rated c
The combination of primitives offered by SMB and AFP in their default configuration allows the arbitrary writing of file
Stack-based buffer overflow in Netatalk versions 2.0.4 through 4.4.2 allows authenticated remote attackers to corrupt me
SQL injection in Netatalk 3.1.0 through 4.4.2 allows authenticated remote attackers to compromise the MySQL-backed CNID
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Synology Dis
Arbitrary file read in Netatalk 3.0.2 through 4.4.2 allows authenticated remote attackers to create attacker-controlled
Path traversal via extended attribute (ea) handling in Netatalk 2.1.0 through 4.4.2 allows authenticated remote attacker
Shell injection in Netatalk 3.1.4 through 4.4.2 allows authenticated remote attackers to execute arbitrary OS commands t
Out-of-bounds write in Netatalk versions 2.0.4 through 4.4.2 stems from a missing o_len bounds check in the pull_charset
Same weakness CWE-682 – Incorrect Calculation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today