Netatalk DSI OpenSession Processing Switch Case Fall-Through Vulnerability

A vulnerability exists in Netatalk versions 1.5.0 through 4.4.2 due to a missing break statement in the DSI OpenSession processing. This flaw causes the DSIOPT_ATTNQUANT switch case to fall through into DSIOPT_SERVQUANT, leading to unintended handling of session options. As a result, a remote attacker could exploit this behavior to cause a minor service disruption by sending crafted DSI session options.

Impact

Exploitation of this vulnerability could result in a minor service disruption.

Remediation

Users can apply the CVE-2026-44075.patch to a Netatalk 4.4.2 source tree to hotfix their local Netatalk deployment. Alternatively, upgrading to Netatalk 4.5.0 or later, which includes the patch, is recommended. However, the Netatalk team does not encourage proactively applying the patch to existing deployments due to the low practical exploitability.