CVE-2026-44061
Timing Side Channel in Netatalk Authentication
Publication date: 2026-05-21
Last updated on: 2026-05-21
Assigner: securin
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| netatalk | netatalk | From 1.5.0 (inc) to 4.4.2 (inc) |
| netatalk | netatalk | 4.5.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-208 | Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Netatalk versions 1.5.0 through 4.4.2 and involves the use of DES-ECB authentication that is susceptible to a timing side channel attack.
A timing side channel attack exploits the time variations in cryptographic operations to gain information about the secret keys or authentication data.
This issue was fixed in Netatalk version 4.5.0.
How can this vulnerability impact me? :
The vulnerability can allow an attacker to exploit timing differences in the DES-ECB authentication process to potentially recover sensitive authentication information.
According to the CVSS v3.1 score of 5.9, the impact is moderate with high confidentiality impact but no impact on integrity or availability.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability in Netatalk versions 1.5.0 through 4.4.2 is fixed in version 4.5.0.
To mitigate this vulnerability, you should upgrade Netatalk to version 4.5.0 or later.