CVE-2026-41458
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
OwnTone Server versions 28.4 through 29.0 contain a race condition vulnerability in the DAAP login handler that allows unauthenticated attackers to crash the server by exploiting unsynchronized access to the global DAAP session list. Attackers can flood the DAAP /login endpoint with concurrent requests to trigger a remote denial of service condition without requiring authentication.
Risk Assessment
The risk is that an unauthenticated attacker can remotely crash the server, causing service disruption and potential loss of availability for users.
Recommendation
It is recommended to immediately upgrade OwnTone Server to a version later than 29.0, which includes a fix for the race condition in DAAP.
Other vulnerabilities in OwnTone Server
Original NVD description (English source)
OwnTone Server versions 28.4 through 29.0 contain a race condition vulnerability in the DAAP login handler that allows unauthenticated attackers to crash the server by exploiting unsynchronized access to the global DAAP session list. Attackers can flood the DAAP /login endpoint with concurrent requests to trigger a remote denial of service condition without requiring authentication.