CVE-2026-41458
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
OwnTone Server versions 28.4 through 29.0 contain a race condition vulnerability in the DAAP login handler that allows unauthenticated attackers to crash the server by exploiting unsynchronized access to the global DAAP session list. Attackers can flood the DAAP /login endpoint with concurrent requests to trigger a remote denial of service condition without requiring authentication.
Risk Assessment
The risk is that an unauthenticated attacker can remotely crash the server, causing service disruption and potential loss of availability for users.
Recommendation
It is recommended to immediately upgrade OwnTone Server to a version later than 29.0, which includes a fix for the race condition in DAAP.
Other vulnerabilities in OwnTone Server
See all- CVE-2026-120441Medium
OwnTone Server through 29.3 contains an SQL injection vulnerability in mpd_sticker_find() in src/mpd.c that allows unauthenticated remote attackers to inject SQL via the URI argument. A crafted 'sticker find song' command to the MPD listener on TCP port 6600 bypasses path restrictions and enumerates all media files with filesystem paths and metadata.
- CVE-2026-41457Medium
OwnTone Server versions 28.4 through 29.0 contain a SQL injection vulnerability in DAAP query and filter handling. Attackers can inject arbitrary SQL expressions via the query= and filter= parameters for integer-mapped DAAP fields.
Original NVD description (English source)
OwnTone Server versions 28.4 through 29.0 contain a race condition vulnerability in the DAAP login handler that allows unauthenticated attackers to crash the server by exploiting unsynchronized access to the global DAAP session list. Attackers can flood the DAAP /login endpoint with concurrent requests to trigger a remote denial of service condition without requiring authentication.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS