Netatalk vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-45698 Netatalk is a Free and Open Source file server suite for Unix-like operating systems.High 7.5 · Aug 17, 2026
• CVE-2026-45699 Netatalk is a Free and Open Source file server suite for Unix-like operating systems.High 7.5 · Aug 14, 2026
• CVE-2026-44068 Incomplete sanitization of extended attribute (EA) path components in Netatalk 2.1.0 through 4.4.2 allows a remote authenticated attacker to write to files outsHigh 7.6 · May 21, 2026
• CVE-2026-44066 Multiple heap out-of-bounds reads in the Spotlight RPC unmarshalling code in Netatalk 3.1.0 through 4.4.2 allow a remote authenticated attacker to obtain sensitHigh 7.1 · May 21, 2026
• CVE-2026-44064 An out-of-bounds read in ASP session ID handling in Netatalk 1.3 through 4.4.2 allows an adjacent network attacker to obtain limited information or cause a deniHigh 7.1 · May 21, 2026
• CVE-2026-44062 A missing output length bounds check in pull_charset_flags() in Netatalk 2.0.4 through 4.4.2 allows a remote authenticated attacker to execute arbitrary code orHigh 7.5 · May 21, 2026
• CVE-2026-44060 An integer underflow in dsi_writeinit() in Netatalk 1.5.0 through 4.4.2 allows a remote unauthenticated attacker to cause a denial of service via a crafted DSI High 7.5 · May 21, 2026
• CVE-2026-44058 An authentication bypass vulnerability in Netatalk 2.2.2 through 4.4.2 allows a remote privileged user to authenticate as an arbitrary user via the admin auth uHigh 7.2 · May 21, 2026
• CVE-2026-44055 A logic error involving bitwise OR operations in Netatalk 3.1.4 through 4.4.2 allows a remote authenticated attacker to inject OS commands and execute arbitraryHigh 7.5 · May 21, 2026
• CVE-2026-44053 Netatalk 1.5.0 through 4.2.2 uses a broken cryptographic algorithm in the DHCAST128 UAM, which allows a remote attacker to obtain authentication credentials or High 7.4 · May 21, 2026
• CVE-2026-44052 Netatalk 2.1.0 through 4.4.2 inserts LDAP simple-bind passwords into log output in cleartext, which allows an attacker with access to the log files to obtain LDHigh 7.5 · May 21, 2026
• CVE-2026-44051 An improper link resolution vulnerability in Netatalk 3.0.2 through 4.4.2 allows a remote authenticated attacker to read arbitrary files or overwrite arbitrary High 8.1 · May 21, 2026
• CVE-2026-44050 A heap-based buffer overflow in the CNID daemon comm_rcv() function in Netatalk 2.0.0 through 4.4.2 allows a remote authenticated attacker to execute arbitrary Critical 9.9 · May 21, 2026
• CVE-2026-44049 An out-of-bounds write due to improper null termination in convert_charset() in Netatalk 2.0.4 through 4.4.2 allows a remote authenticated attacker to execute aHigh 7.5 · May 21, 2026
• CVE-2026-44048 A stack-based buffer overflow via UCS-2 type confusion in convert_charset() in Netatalk 2.0.4 through 4.4.2 allows a remote authenticated attacker to execute arHigh 8.8 · May 21, 2026
• CVE-2026-44047 An SQL injection vulnerability in the MySQL CNID backend in Netatalk 3.1.0 through 4.4.2 allows a remote authenticated attacker to obtain unauthorized access toHigh 8.8 · May 21, 2026
• CVE-2024-38441 Netatalk before 3.2.1 has an off-by-one error and resultant heap-based buffer overflow because of setting ibuf[len] to '\0' in FPMapName in afp_mapname in etc/aCritical 9.8 · Jun 16, 2024
• CVE-2024-38440 Netatalk before 3.2.1 has an off-by-one error, and resultant heap-based buffer overflow and segmentation violation, because of incorrectly using FPLoginExt in BHigh 7.5 · Jun 16, 2024
• CVE-2024-38439 Netatalk before 3.2.1 has an off-by-one error and resultant heap-based buffer overflow because of setting ibuf[PASSWDLEN] to '\0' in FPLoginExt in login in etc/Critical 9.8 · Jun 16, 2024
• CVE-2023-42464 A Type Confusion vulnerability was found in the Spotlight RPC functions in afpd in Netatalk 3.1.x before 3.1.17.Critical 9.8 · Sep 20, 2023
• CVE-2022-43634 This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk.Critical 9.8 · Mar 29, 2023
• CVE-2022-23125 This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk.Critical 9.8 · Mar 28, 2023
• CVE-2022-23124 This vulnerability allows remote attackers to disclose sensitive information on affected installations of Netatalk.Critical 9.8 · Mar 28, 2023
• CVE-2022-23123 This vulnerability allows remote attackers to disclose sensitive information on affected installations of Netatalk.Critical 9.8 · Mar 28, 2023
• CVE-2022-23122 This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk.Critical 9.8 · Mar 28, 2023