Netatalk vulnerabilities

Summary

Arjun Basnet discovered that Netatalk incorrectly sanitized user input in its MySQL CNID backend. A remote authenticated attacker could possibly use this issue to conduct SQL injection attacks. (CVE-2026-44047) Arjun Basnet discovered that Netatalk incorrectly handled UCS-2 character set conversion. A remote authenticated attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-44048) Arjun Basnet discovered that Netatalk improperly handled null termination during character set conversion. A remote authenticated attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-44049) Arjun Basnet discovered that the Netatalk CNID daemon improperly handled request-supplied name lengths. A local attacker could possibly use this issue to cause a denial of service or execute arbitrary code with escalated privileges. (CVE-2026-44050) Arjun Basnet discovered that Netatalk improperly resolved symbolic links. A remote authenticated attacker could possibly use this issue to read or overwrite arbitrary files on the system. (CVE-2026-44051) Arjun Basnet discovered that Netatalk incorrectly handled logging when performing LDAP simple-bind operations. A local attacker could possibly use this issue to obtain sensitive information. (CVE-2026-44052) Arjun Basnet discovered that Netatalk contained an operator Affected Ubuntu releases: 26.04, 24.04, 22.04, 20.04, 18.04, 16.04, 14.04. CVEs: CVE-2026-44051, CVE-2026-44060, CVE-2026-44047, CVE-2026-44055, CVE-2026-44062, CVE-2026-44049, CVE-2026-44048, CVE-2026-44050….