EUVD-2026-31217
GHSA-vmvv-qm72-v4fg
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
Lifecycle Timeline
1DescriptionCVE.org
In Netatalk 2.0.0 through 4.4.2, unbounded realloc in charset conversion. Fixed in 4.5.0.
AnalysisAI
Unbounded realloc during charset conversion in Netatalk 2.0.0 through 4.4.2 allows an authenticated remote attacker to trigger excessive memory allocation, resulting in limited availability impact. The flaw is classified under CWE-770 (resource allocation without limits) and carries a low CVSS score of 3.1, reflecting constrained exploitability due to high attack complexity and required authentication. No public exploit code or active exploitation has been identified at time of analysis; a fix was released in version 4.5.0.
Technical ContextAI
Netatalk is an open-source implementation of Apple's AFP (Apple Filing Protocol) and related Apple networking services for Unix/Linux hosts, enabling macOS clients to mount and interact with remote file shares. The vulnerable code path lies in the charset conversion subsystem, which translates between character encodings (e.g., UTF-8, Mac Roman) during file name and metadata processing. The root cause is CWE-770: a realloc() call within this conversion routine lacks an upper bound on allocation size, meaning specially crafted input can cause the process to repeatedly expand a memory buffer without constraint. Over time or under sustained input, this exhausts available memory on the host, degrading or disrupting the AFP service. The affected CPE is cpe:2.3:a:netatalk:netatalk:*:*:*:*:*:*:*:* covering versions 2.0.0 through 4.4.2 per EUVD-2026-31217 and NVD data.
RemediationAI
The vendor-released patch is Netatalk 4.5.0. Administrators should upgrade from any version in the 2.0.0-4.4.2 range to 4.5.0 or later. The vendor advisory is available at https://netatalk.io/security/CVE-2026-44070. For environments where an immediate upgrade is not feasible, compensating controls include restricting AFP service access to trusted network segments via firewall rules (blocking TCP port 548), requiring strong authentication to limit the pool of users who can send charset-triggering input, and monitoring process memory usage of the netatalk daemon to detect abnormal growth and trigger automated restarts. These controls reduce exposure but do not eliminate the underlying flaw.
Netatalk before 3.1.12 is vulnerable to an out of bounds write in dsi_opensess.c. Rated critical severity (CVSS 9.8), th
Netatalk through 3.1.13 has an afp_getappl heap-based buffer overflow resulting in code execution via a crafted .appl fi
A Type Confusion vulnerability was found in the Spotlight RPC functions in afpd in Netatalk 3.1.x before 3.1.17. Rated c
The combination of primitives offered by SMB and AFP in their default configuration allows the arbitrary writing of file
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Synology Dis
Integer underflow in Netatalk's volxlate function affects all releases from 3.0.0 through 4.4.2, an open-source AFP (App
Netatalk versions 3.1.2 through 4.4.2 are distributed as binaries compiled without the FORTIFY_SOURCE flag, stripping aw
Incorrect errno calculation in Netatalk 2.1.0 through 4.4.2 allows remote unauthenticated attackers to cause minor servi
Missing break statement in Netatalk's DSI OpenSession handler allows DSIOPT_ATTNQUANT case to fall through into DSIOPT_S
TOCTOU race condition in Netatalk's ad_flush function across versions 3.0.0 through 4.4.2 exposes root-privileged file o
Format string argument mismatch in Netatalk 3.0.3 through 4.4.2 allows authenticated network attackers to cause low-seve
Information disclosure in Netatalk 3.0.0 through 4.4.2 stems from a dead bounds check (CWE-561) in the Spotlight RPC unm
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today