An unbounded memory reallocation in the charset conversion code of Netatalk 2.0.0 through 4.4.2 allows a remote authenticated attacker to cause a minor denial of service via crafted character conversion requests. The flaw arises during dynamic memory allocation of multibyte character conversions, where an unbounded realloc operation can exhaust memory or trigger a crash. This results in a denial‑of‑service condition affecting availability of the Netatalk service. Though the CVSS score of 3.1 indicates a low overall risk, the potential for service interruption can be critical on production systems.

The bug is present in Netatalk releases from 2.0.0 up to and including 4.4.2. All deployments running any affected Netatalk version should be evaluated, including both server and client components that perform charset conversion.

The CVSS score of 3.1 reflects the low impact, and there is no EPSS data or KEV listing, suggesting that the vulnerability has not been widely exploited in the wild. The updated description indicates that a remote authenticated attacker can trigger the flaw via crafted character conversion requests, making the attack vector remote but requiring authentication to the Netatalk service. Because the flaw does not provide data disclosure or code execution, the primary risk remains a remote denial of service.