Netatalk versions 1.5.0 through 4.2.2 use a broken cryptographic algorithm in the DHCAST128 UAM. The flaw can be broken by cryptanalysis, enabling a remote attacker to recover authentication credentials or impersonate a user, thereby undermining the integrity and authenticity of Netatalk sessions.

Netatalk releases 1.5.0 to 4.2.2 are affected. The vulnerability was discovered in the DHCAST128 UAM implementation and is present in all builds within that range. No specific patch version is announced in the CVE data.

The vulnerability carries a CVSS score of 7.4, indicating high severity, and no EPSS score is provided, leaving exploitation probability unknown. It is not listed in the CISA KEV catalog. The attack vector is most likely remote over the network, where an attacker initiates or intercepts a Netatalk session that relies on the weak DHCAST128 UAM and then performs cryptanalytic analysis to compromise credentials.