The vulnerability is a missing break statement in the DSI OpenSession processing of Netatalk 1.5.0 through 4.4.2. The DSIOPT_ATTNQUANT case falls through to DSIOPT_SERVQUANT, enabling unintended session option handling. An attacker that can send crafted DSI session options may force the daemon to misinterpret options and cause a minor service disruption. The weakness is captured as CWE‑484, Incorrect Open‑Ended Input.

Affected vendor: Netatalk. Affected product: Netatalk server software. Versions 1.5.0 through 4.4.2 are impacted. Customers should verify the installed version falls within this range.

The CVSS score of 3.7 indicates low severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting a relatively low exploitation likelihood. An attacker would need remote access to the Netatalk service and ability to send malformed DSI session options, implying the attack vector is remote network. Successful exploitation could lead to a service disruption but not to code execution or data compromise.