CVE Catalog
CVE-2026-44061
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk0.39%
31th percentile - higher than 31% of all known CVEs
Summary
A vulnerability in Netatalk versions 1.5.0 through 4.4.2 uses DES-ECB for authentication with a timing side channel, allowing a remote attacker to recover authentication credentials via timing analysis.
Risk Assessment
The risk involves potential credential theft by an attacker without physical access, leading to unauthorized access to Netatalk file services.
Recommendation
Immediately update Netatalk to version 4.4.3 or later. If not possible, restrict access to Netatalk services to trusted networks only.
Original NVD description (English source)
Netatalk 1.5.0 through 4.4.2 uses DES-ECB for authentication with a timing side channel, which allows a remote attacker to recover authentication credentials via timing analysis.