USN-8455-1

Arjun Basnet discovered that Netatalk improperly validated inputs when unmarshalling Spotlight Remote Procedure Call. A remote authenticated attacker could possibly use this issue to cause a denial of service or obtain sensitive information. (CVE-2026-44066)

Arjun Basnet discovered that Netatalk improperly sanitized extended attribute path components. A remote authenticated attacker could possibly use this issue to perform path traversal attacks and write to arbitrary files outside the intended metadata directory. (CVE-2026-44068)