CVE 2026 7835

netatalk.io • July 16, 2026

A logging statement on an allocation-failure path has mismatched format arguments. The format string is fixed, so this is not a practical attacker-controlled format-string issue; impact is limited to a possible crash while logging under low-memory conditions.

Apply CVE-2026-44059,CVE-2026-7835.patch to a Netatalk 4.4.2 source tree to hotfix your local Netatalk deployment.

Alternatively, upgrade to Netatalk 4.5.0 or later, which includes the patch.

The Netatalk team does not encourage proactively applying the patch to existing deployments because of the low practical exploitability.

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L (3.1)

No practical workaround is available beyond applying the patch; monitor for memory pressure that could exercise the allocation failure path.

Vulnerability reported by:

Arjun Basnet from Securin

Daniel Markstedt of the Netatalk team

Go back to the Security Policy .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CVE-2026-7835: Format String Vulnerability in Netatalk CVE-2026-7835 is a format string vulnerability in Netatalk affecting versions prior to 4.4.3. It arises from a mismatch between format specifiers and argument types in logging functions, which could lead to stack memory disclosure or daemon instability. The vulnerability can be triggered by an authenticated AFP client under specific conditions. While the risk of exploitation is considered low, it is recommended to upgrade to Netatalk 4.4.3 or later to mitigate the issue. The Netatalk team has released a patch, but they do not encourage applying it proactively due to low exploitability. The vulnerability was reported by Arjun Basnet from Securin and Daniel Markstedt from the Netatalk team. The CVSS score for this vulnerability is 3.1, indicating low impact. 2 sources 43

Extracted Entities

Companies (2)

Netatalk Securin

CVEs (2)

CVE-2026-44059 CVE-2026-7835