CVE-2026-44075

Published: May 21, 2026Modified: Jul 23, 2026Deferred

3.7

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Exploitability: 2.2 / Impact: 1.4

Source: 33c584b5-0579-4c06-b2a0-8d8329fcab9c (Secondary)

Description

A missing break statement in DSI OpenSession processing in Netatalk 1.5.0 through 4.4.2 causes a DSIOPT_ATTNQUANT switch case to fall through into DSIOPT_SERVQUANT, resulting in unintended session option handling that may allow a remote attacker to cause a minor service disruption via crafted DSI session options.

Related CWEs

CWE-484

Omitted Break Statement in Switch

The product omits a break statement within a switch or similar construct, causing code associated with multiple conditions to execute. This can cause problems when the programmer only intended to execute code associated with one condition.

References (1)

https://netatalk.io/security/CVE-2026-44075

Source: 33c584b5-0579-4c06-b2a0-8d8329fcab9c

Timeline

No history available yet.