Netatalk versions 2.0.0 through 4.4.2 generate AFP session tokens derived from predictable process IDs. This weakness allows a remote authenticated attacker to cause a denial of service by triggering the reconnect mechanism in afpd. The flaw involves improper random number generation (CWE-330) and results in service disruption rather than session hijacking.

Vendors and products affected include Netatalk, specifically all releases from 2.0.0 up to and including 4.4.2. No fixed version is referenced in the CVE data; users should verify with the vendor whether a patch is available.

The CVSS score of 6.5 indicates moderate severity. The EPSS score is not available, so the likelihood of exploitation is unknown. The vulnerability is not listed in CISA KEV. The description indicates that a remote authenticated attacker can exploit the predictable session tokens to repeatedly trigger the afpd reconnect mechanism, leading to denial of service. Exploitation requires authentication to afpd and the ability to send requests that cause reconnection; no additional privileges are needed beyond those used for standard file-sharing access. The lack of detailed exploitation conditions implies that the threat is limited to attackers who have established authentication to afpd or are able to obtain such credentials.