Netatalk CVE-2026-44075

The Netatalk AFP/DSI service must be running and accepting connections on TCP port 548 (or a configured alternative port) for exploitation to be possible. The vulnerability is triggered specifically during DSI OpenSession negotiation, meaning the attacker must initiate a new AFP session. No authentication is required (PR:N per CVSS vector). Attack complexity is rated High (AC:H), indicating that simply sending any malformed packet is insufficient - the attacker must construct a DSI OpenSession packet where the DSIOPT_ATTNQUANT data, when also processed as DSIOPT_SERVQUANT, produces the disruptive condition. This limits exploitation to adversaries with AFP/DSI protocol knowledge. Impact is bounded to availability: minor service disruption affecting the target session only (A:L, S:U), with no confidentiality or integrity impact confirmed.

CVSS 3.7 Low reflects a genuine low-severity issue: network-reachable (AV:N) but requiring high attack complexity (AC:H), no privileges (PR:N), no user interaction (UI:N), unchanged scope (S:U), and limited exclusively to availability (C:N/I:N/A:L). The AC:H rating is a meaningful constraint - reliable exploitation requires carefully crafted DSI packets, not a trivial off-the-shelf attack. No EPSS score was provided in the input data, making probabilistic exploitation likelihood unquantifiable from this source. No KEV listing exists, confirming no confirmed active exploitation. No public POC has been identified. The source metadata tags this as 'Information Disclosure,' which conflicts directly with the CVSS impact vector of C:N - this tagging appears to be a metadata error and confidentiality impact should be treated as unconfirmed. Overall, this is a genuine low-priority vulnerability: real but narrow impact, no exploitation evidence, and constrained by attack complexity.

An unauthenticated attacker with network access to TCP port 548 sends a crafted DSI OpenSession request containing a precisely structured DSIOPT_ATTNQUANT option value designed to produce anomalous behavior when additionally interpreted as DSIOPT_SERVQUANT data. The Netatalk server processes the option under both case handlers due to the missing break, resulting in corrupted session parameter state and a minor service disruption for the affected session. The AC:H rating means this requires deliberate packet engineering rather than opportunistic scanning tools.