Linux · Fedora · Security advisory · May 22, 2026

FEDORA-2026-9FD50B2FF1: Security update for 9 packages

FEDORA-2026-9FD50B2FF1, released May 22, 2026, fixes 15 CVEs across 9 products. None of them is reported as exploited. Patch Radar priority: Urgent.

Urgent
CVEs closed
15
1 rated Critical
Exploited
0
None reported
Highest CVSS
9.9
Base score, 0 to 10
Highest EPSS
0.0052
44th percentile

Priority of the 15 CVEs

Patch now 0 Urgent 1 High 10 Routine 4

Fixed package versions

ProductReleaseFixed in
netatalkFedora 435:4.4.3-1.fc43
netatalk-afptestFedora 435:4.4.3-1.fc43
netatalk-afptest-debuginfoFedora 435:4.4.3-1.fc43
netatalk-appletalkFedora 435:4.4.3-1.fc43
netatalk-appletalk-debuginfoFedora 435:4.4.3-1.fc43
netatalk-debuginfoFedora 435:4.4.3-1.fc43
netatalk-debugsourceFedora 435:4.4.3-1.fc43
netatalk-develFedora 435:4.4.3-1.fc43
netatalk-docFedora 435:4.4.3-1.fc43

CVEs this fix closes

PriorityCVETitleCVSSEPSSExploitation
Urgent CVE-2026-44050 netatalk: A heap-based buffer overflow in the CNID daemon comm_rcv() function in Netatalk 2.0.0 through 4.4.2 allows a remote a...9.9 0.0042 None reported
High CVE-2026-44049 netatalk: An out-of-bounds write due to improper null termination in convert_charset() in Netatalk 2.0.4 through 4.4.2 allows a...7.5 0.0052 None reported
High CVE-2026-44048 netatalk: A stack-based buffer overflow via UCS-2 type confusion in convert_charset() in Netatalk 2.0.4 through 4.4.2 allows a...8.8 0.0042 None reported
High CVE-2026-44047 netatalk: An SQL injection vulnerability in the MySQL CNID backend in Netatalk 3.1.0 through 4.4.2 allows a remote authenticate...8.8 0.0037 None reported
High CVE-2026-44055 netatalk: A logic error involving bitwise OR operations in Netatalk 3.1.4 through 4.4.2 allows a remote authenticated attacker...7.5 0.0036 None reported
High CVE-2026-44062 netatalk: A missing output length bounds check in pull_charset_flags() in Netatalk 2.0.4 through 4.4.2 allows a remote authenti...7.5 0.0036 None reported
High CVE-2026-44060 netatalk: An integer underflow in dsi_writeinit() in Netatalk 1.5.0 through 4.4.2 allows a remote unauthenticated attacker to c...7.5 0.0033 None reported
High CVE-2026-44068 netatalk: Incomplete sanitization of extended attribute (EA) path components in Netatalk 2.1.0 through 4.4.2 allows a remote au...7.6 0.0032 None reported
High CVE-2026-44066 netatalk: Multiple heap out-of-bounds reads in the Spotlight RPC unmarshalling code in Netatalk 3.1.0 through 4.4.2 allow a rem...7.1 0.0029 None reported
High CVE-2026-44052 netatalk: Netatalk 2.1.0 through 4.4.2 inserts LDAP simple-bind passwords into log output in cleartext, which allows an attacke...7.5 0.0025 None reported
High CVE-2026-44064 netatalk: An out-of-bounds read in ASP session ID handling in Netatalk 1.3 through 4.4.2 allows an adjacent network attacker to...7.1 0.0017 None reported
Routine CVE-2026-44054 netatalk: Netatalk 2.0.0 through 4.4.2 generates AFP session tokens derived from predictable process IDs, which allows a remote...6.5 0.0028 None reported
Routine CVE-2026-44057 netatalk: A dead bounds check in the Spotlight RPC unmarshaller in Netatalk 3.0.0 through 4.4.2 results in an unreachable code...3.1 0.0019 None reported
Routine CVE-2026-44076 netatalk: Insufficient sanitization of volume paths in Netatalk 3.1.0 through 4.4.2 allows a local privileged user to inject OS...6.7 0.0013 None reported
Routine CVE-2026-44069 netatalk: An integer underflow in the volxlate function in Netatalk 3.0.0 through 4.4.2 allows a local privileged user to obtai...3.9 0.0009 None reported
Showing 1 to 15 of 15 1

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.