CVE-2026-44061: DES-ECB auth with timing side channel
Netatalk 1.5.0 through 4.4.2 uses DES-ECB for authentication with a timing side channel, which allows a remote attacker to recover authentication credentials via timing analysis.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/netatalkto a version that resolves this vulnerability.Fixed in 4.5.0-r0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44061?
The severity of CVE-2026-44061 is rated as medium with a score of 5.9.
How do I fix CVE-2026-44061?
To fix CVE-2026-44061, upgrade to Netatalk version 4.5.0 or later.
What is the main risk associated with CVE-2026-44061?
The main risk associated with CVE-2026-44061 is remote attackers potentially recovering authentication credentials through timing analysis.
Which versions of Netatalk are affected by CVE-2026-44061?
Netatalk versions from 1.5.0 through 4.4.2 are affected by CVE-2026-44061.
What type of attack does CVE-2026-44061 involve?
CVE-2026-44061 involves a timing side channel attack related to DES-ECB authentication.