Use-after-free in Netatalk - CVE-2026-62318
Published: November 9, 2026
Vulnerability identifier: #VU162850
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-62318
CWE-ID: CWE-416
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to cause denial of service by crashing Netatalk afpd workers before authentication completes.
The vulnerability exists due to missing state validation in the DHX2/DHX2-PAM authentication module, allowing repeated FPLoginCont packets with the same session ID to reuse and free released memory when either module is enabled. An unauthenticated remote attacker can repeatedly connect to the AFP TCP listener and trigger worker crashes without terminating the parent listener.
Affected software
Netatalk
How to mitigate CVE-2026-62318
Install security update from vendor's website.
Netatalk - update to 4.5.1