CVE-2026-44075
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
A missing break statement in DSI OpenSession processing in Netatalk 1.5.0 through 4.4.2 causes a fall-through from DSIOPT_ATTNQUANT to DSIOPT_SERVQUANT. A remote attacker can cause minor service disruption via crafted DSI session options.
Risk Assessment
The organization may experience minor service disruptions in Netatalk services due to a remote attacker manipulating DSI session options.
Recommendation
Upgrade Netatalk to version 4.4.3 or later, which includes a fix for this issue.
Original NVD description (English source)
A missing break statement in DSI OpenSession processing in Netatalk 1.5.0 through 4.4.2 causes a DSIOPT_ATTNQUANT switch case to fall through into DSIOPT_SERVQUANT, resulting in unintended session option handling that may allow a remote attacker to cause a minor service disruption via crafted DSI session options.