CVE-2026-44074

LowCVSS 3.7/10Last modified Jul 23, 2026

Description

Netatalk 2.1.0 through 4.4.2 combines multiple errno values using bitwise OR, resulting in incorrect error codes when multiple error conditions occur simultaneously, which may allow a remote attacker to cause a minor service disruption via conditions that trigger incorrect error-handling paths.

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-682

Affected software

Vendor	Product	Versions
Netatalk	Netatalk	>= 2.1.0, <= 4.4.2

References

https://netatalk.io/security/CVE-2026-44074

Timeline

Published: May 21, 2026
Last modified: Jul 23, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-440753.7A missing break statement in DSI OpenSession processing in Netatalk 1.5.0 through 4.4.2 causes a DSIOPT_ATTNQUANT switch case to fall throug CVE-2026-440766.7Insufficient sanitization of volume paths in Netatalk 3.1.0 through 4.4.2 allows a local privileged user to inject OS commands and execute a CVE-2026-44089.8A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use th CVE-2026-440839.8An authorization bypass through user-controlled key vulnerability has been reported to affect QuMagie. The remote attackers can then exploit CVE-2026-440847.5An authorization bypass through user-controlled key vulnerability has been reported to affect Video Station. If exploited, the vulnerability CVE-2026-440879.1Insufficient Verification of Data Authenticity vulnerability in Apache APISIX. The openid-connect plugin under default configuration has an CVE-2026-440888.6SzafirHost verifies the signature of the downloaded JAR file using class JarInputStream (reading from the beginning of the file), but loads CVE-2026-440899.4Totolink EX1200L router is vulnerable to Buffer Overflow in the login functionality in cgi-bin/cstecgi.cgi endpoint. This vulnerability coul CVE-2026-44096.5The Subscribe To Comments Reloaded plugin for WordPress is vulnerable to unauthorized modification of data due to a leaked secret key and us CVE-2026-440909.8Due to missing authentication, an unauthenticated remote attacker may access the MQTT broker, which is only protected from external access b CVE-2026-440919.1An unauthenticated remote attacker can post a malicious ID to the MQTT Broker results in the creation of a new configuration entry in the sy CVE-2026-440929.1An unauthenticated remote attacker can inject malicious input into the ModbusServer application because it does not validate the input it fe