Netatalk, an AFP server implementation, has a format string argument mismatch vulnerability affecting versions 3.0.3 through 4.4.2. This flaw is classified as CWE‑134 and allows a remote authenticated attacker to trigger a minor denial of service by crafting input that causes incorrect format string processing. The CVSS score of 3.1 indicates a low‑severity risk in typical environments.

The affected product is Netatalk, distributed under the Netatalk:Netatalk product line. The vulnerability exists in Netatalk releases 3.0.3 up to and including 4.4.2. The CVE data does not indicate a fixed version.

The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, which combined with the low CVSS score suggests limited exploitation probability. The attack vector is not explicitly documented, but based on the description it is inferred to be remote authenticated, with a local effect triggering a minor denial of service; no purely remote exploitation path is indicated.