CVE Feed

    Dashboard / CVE / CVE-2026-41458

    CVE-2026-41458

    OwnTone Server versions 28.4 through 29.0 contain a race condition vulnerability in the DAAP login handler that allows unauthenticated attackers to crash the server by exploiting unsynchronized access to the global DAAP session list. Attackers can flood the DAAP /login endpoint with concurrent requests to trigger a remote denial of service condition without requiring authentication.

    Published:Apr 22, 2026
    Last Modified:Jul 14, 2026
    EPS:Apr 22, 2026
    EPSS Score:0.00364
    CVSS Score:8.2

    Affected Products

    Vendor
    Owntone
    Product
    Owntone Server
    Vendor
    Owntone
    Product
    Server

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-41457 (CVSS 6.9) — OwnTone Server versions 28.4 through 29.0 contain a SQL injection vulnerability in DAAP query and filter handl…
    CVE-2025-63647 (CVSS 7.5) — A NULL pointer dereference in the parse_meta function (src/httpd_daap.c) of owntone-server commit 334beb allow…
    CVE-2025-63648 (CVSS 7.5) — A NULL pointer dereference in the dacp_reply_playqueueedit_move function (src/httpd_dacp.c) of owntone-server …
    CVE-2025-57156 (CVSS 7.5) — NULL pointer dereference in the dacp_reply_playqueueedit_clear function in src/httpd_dacp.c in owntone-server …
    CVE-2025-57155 (CVSS 7.5) — NULL pointer dereference in the daap_reply_groups function in src/httpd_daap.c in owntone-server through commi…
    CVE-2021-38383 (CVSS 9.8) — OwnTone (aka owntone-server) through 28.1 has a use-after-free in net_bind() in misc.c.…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High