Vulnerabilidades de Owntone
CVEs publicadas que afetam produtos de Owntone: 6 registro(s), com severidade, exploração e correções.
CVE-2026-41458
Alta · 8.2
CWE-362 22/04/2026
OwnTone Server < 29.1 Race Condition DoS via DAAP Login
OwnTone Server versions 28.4 through 29.0 contain a race condition vulnerability in the DAAP login handler that allows unauthenticated attackers to crash the server by exploiting unsynchronized access to the global DAAP session list. Attackers can flood the DAAP /login endpoint with concurrent requests to trigger a remote denial of service condition without requiring authentication.
CVE-2026-41457
Média · 6.9
CWE-89 22/04/2026
OwnTone Server < 29.1 SQL Injection via query and filter Parameters
OwnTone Server versions 28.4 through 29.0 contain a SQL injection vulnerability in DAAP query and filter handling that allows attackers to inject arbitrary SQL expressions by supplying malicious values through the query= and filter= parameters for integer-mapped DAAP fields. Attackers can exploit insufficient sanitization of these parameters to bypass filters and gain unauthorized access to media library data.
CVE-2025-63648
Alta · 7.5
CWE-476 20/01/2026
NULL Pointer Dereference em Owntone Owntone Server
A NULL pointer dereference in the dacp_reply_playqueueedit_move function (src/httpd_dacp.c) of owntone-server commit b7e385f allows attackers to cause a Denial of Service (DoS) via sending a crafted DACP request to the server.
CVE-2025-63647
Alta · 7.5
CWE-476 20/01/2026
NULL Pointer Dereference em Owntone Owntone Server
A NULL pointer dereference in the parse_meta function (src/httpd_daap.c) of owntone-server commit 334beb allows attackers to cause a Denial of Service (DoS) via sending a crafted DAAP request to the server.
CVE-2025-57156
Alta · 7.5
CWE-476 20/01/2026
NULL Pointer Dereference em Owntone Owntone Server
NULL pointer dereference in the dacp_reply_playqueueedit_clear function in src/httpd_dacp.c in owntone-server through commit 6d604a1 (newer commit after version 28.12) allows remote attackers to cause a Denial of Service (crash).
CVE-2025-57155
Alta · 7.5
CWE-476 20/01/2026
NULL Pointer Dereference em Owntone Owntone Server
NULL pointer dereference in the daap_reply_groups function in src/httpd_daap.c in owntone-server through commit 5e6f19a (newer commit after version 28.2) allows remote attackers to cause a Denial of Service.