SB20261109113 - Multiple vulnerabilities in Netatalk

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261109113

SB20261109113 - Multiple vulnerabilities in Netatalk

Published: November 9, 2026 Updated: November 11, 2026

Security Bulletin ID SB20261109113
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 75% Low 25%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 vulnerabilities.


1) Out-of-bounds write (CVE-ID: CVE-2026-62321)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an authenticated remote attacker to corrupt heap memory in Netatalk's AFP server.

The vulnerability exists due to incorrect buffer capacity checks in the afpd Spotlight RPC reply marshaller when serializing nested file metadata into a partially filled reply buffer. An authenticated remote attacker can submit a crafted Spotlight query on a Spotlight-enabled AFP volume to generate oversized metadata and write beyond the heap-allocated reply buffer.


2) Input validation error (CVE-ID: CVE-2026-62319)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated attacker to smuggle DSI requests and desynchronize an AFP connection to Netatalk.

The vulnerability exists due to missing validation in the afpd DSIWrite receive path when a request's data offset exceeds its declared frame length. A remote authenticated attacker can send a malformed frame followed by queued data, causing the server to consume bytes beyond the frame boundary and parse an attacker-controlled subsequent DSI header and payload.


3) Use-after-free (CVE-ID: CVE-2026-62318)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to cause denial of service by crashing Netatalk afpd workers before authentication completes.

The vulnerability exists due to missing state validation in the DHX2/DHX2-PAM authentication module, allowing repeated FPLoginCont packets with the same session ID to reuse and free released memory when either module is enabled. An unauthenticated remote attacker can repeatedly connect to the AFP TCP listener and trigger worker crashes without terminating the parent listener.


4) Improper Handling of Length Parameter Inconsistency (CVE-ID: CVE-2026-62320)

CWE-ID: CWE-130 - Improper Handling of Length Parameter Inconsistency

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to smuggle attacker-controlled DSI requests into the same connection.

The vulnerability exists due to improper handling of length parameter inconsistency in Netatalk afpd's dsi_tcp_open() when processing frames whose declared dsi_len exceeds server_quantum, silently truncating reads without rejecting the frame or draining remaining bytes. A remote attacker can send an oversized DSI frame containing embedded frames to make subsequent receive operations interpret leftover payload bytes as new requests.


Remediation

Install update from vendor's website.

References