Netatalk 1.5.0 through 4.4.2 uses DES-ECB for authentication with a timing side channel, which allows a remote attacker to recover authentication… (CVE-2026-44061)

Netatalk versions 1.5.0 through 4.4.2 implement authentication using DES in ECB mode, which is susceptible to timing side channel attacks. This cryptographic weakness enables a remote attacker to recover authentication credentials by measuring timing variations during the authentication process. The vulnerability is identified as CVE-2026-44061 with a CVSS 3.1 base score of 5.9, reflecting a network attack vector with high complexity and no privileges required, resulting in high confidentiality impact but no integrity or availability impact. The affected versions explicitly include multiple Ubuntu package versions of Netatalk 2.2.2, 2.2.5, and 2.2.6. There is no vendor advisory or patch information provided to confirm remediation status.

An attacker who exploits this vulnerability can recover authentication credentials remotely by leveraging timing side channel analysis against the DES-ECB authentication mechanism. This compromises the confidentiality of authentication credentials but does not affect integrity or availability of the system. The attack requires network access and has high attack complexity, with no privileges or user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider mitigating exposure by restricting network access to Netatalk services and monitoring for unusual authentication attempts. Avoid relying on DES-ECB for authentication due to its cryptographic weaknesses.