CVE-2026-44075: Netatalk DSI DoS Vulnerability

CVE-2026-44075 Overview

CVE-2026-44075 is a low-severity flaw in Netatalk versions 1.5.0 through 4.4.2. A missing break statement in the Data Stream Interface (DSI) OpenSession processing logic causes the DSIOPT_ATTNQUANT switch case to fall through into DSIOPT_SERVQUANT. This control-flow defect leads to unintended session option handling when a remote client sends crafted DSI session options. The flaw is categorized under [CWE-484] Omitted Break Statement in Switch.

Critical Impact

A remote attacker can trigger minor service disruption by sending crafted DSI session options to a Netatalk server, with no authentication required.

Affected Products

• Netatalk 1.5.0 through 4.4.2
• AFP (Apple Filing Protocol) services exposed through Netatalk
• Network file-sharing deployments using Netatalk for macOS interoperability

Discovery Timeline

• 2026-05-21 - CVE-2026-44075 published to NVD
• 2026-05-21 - Last updated in NVD database

Technical Details for CVE-2026-44075

Vulnerability Analysis

Netatalk implements the Apple Filing Protocol over the Data Stream Interface. During session setup, the server processes a sequence of option tags supplied by the client. The OpenSession handler uses a switch statement to dispatch each option to the correct parsing routine. The defect lies in the DSIOPT_ATTNQUANT case, which lacks the terminating break statement.

When a client supplies the DSIOPT_ATTNQUANT option, execution falls through into the DSIOPT_SERVQUANT case. The server then applies SERVQUANT processing to data the client intended as ATTNQUANT. The result is corrupted session state values that the server later uses for attention quantum and server quantum negotiation.

The attack vector is remote and unauthenticated, but exploitation requires the attacker to craft a valid DSI session option sequence. Impact is limited to availability degradation — confidentiality and integrity remain intact. The defect cannot be leveraged for code execution or data disclosure based on the vendor's analysis.

Root Cause

The root cause is a programmer omission in C-language switch statement construction. Without an explicit break, control transfers linearly to the next case label. This pattern, captured in [CWE-484], is well documented as a source of subtle logic errors. The two adjacent cases process distinct option types, so the fall-through produces incorrect quantum values rather than intentional shared handling.

Attack Vector

An unauthenticated remote attacker connects to the Netatalk DSI listener — typically TCP port 548. The attacker initiates an OpenSession request containing a DSIOPT_ATTNQUANT option with attacker-chosen contents. The server mis-parses the option, leading to inconsistent session quantum values and minor service disruption. High attack complexity reflects the need to reach the listener and shape a syntactically valid DSI request.

No verified public proof-of-concept code is available. Refer to the Netatalk Security Advisory CVE-2026-44075 for protocol-level details.

Detection Methods for CVE-2026-44075

Indicators of Compromise

• Unexpected Netatalk daemon (afpd) crashes, restarts, or session resets logged in syslog
• Inbound TCP connections to port 548 from untrusted networks immediately followed by session teardown
• DSI OpenSession requests containing unusual DSIOPT_ATTNQUANT payload lengths or values

Detection Strategies

• Inspect afpd and Netatalk log files for repeated session option parsing anomalies or abnormal disconnects
• Apply network IDS signatures that flag malformed DSI OpenSession option tags on TCP/548
• Correlate Netatalk process restart events with concurrent inbound traffic spikes from single source addresses

Monitoring Recommendations

• Track Netatalk version inventory across hosts and alert on any installation in the 1.5.0 to 4.4.2 range
• Monitor TCP/548 exposure to the public internet and restrict the service to internal segments
• Enable verbose DSI logging during patch rollout to capture residual exploitation attempts

How to Mitigate CVE-2026-44075

Immediate Actions Required

• Identify all Netatalk installations and confirm the running version against the vulnerable range 1.5.0 through 4.4.2
• Upgrade to the fixed release published by the Netatalk project as documented in the Netatalk Security Advisory CVE-2026-44075
• Restrict TCP/548 access at the network perimeter to authenticated client subnets

Patch Information

The Netatalk maintainers have published a fix that adds the missing break statement in the DSIOPT_ATTNQUANT case of the OpenSession handler. Operators should consult the Netatalk Security Advisory CVE-2026-44075 for the patched version number and source commit reference, then rebuild or install the updated package from the official distribution channels.

Workarounds

• Block inbound connections to TCP port 548 from untrusted networks using host or perimeter firewalls
• Disable the Netatalk service on hosts where AFP file sharing is not required
• Place Netatalk servers behind a VPN or zero-trust gateway to limit reachability to authenticated users

# Restrict Netatalk DSI listener to trusted subnet (iptables example)
iptables -A INPUT -p tcp --dport 548 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 548 -j DROP

# Stop and disable Netatalk where AFP is not required
systemctl stop netatalk
systemctl disable netatalk