CVE-2026-41458

OwnTone Server < 29.1 Race Condition DoS via DAAP Login

State: Published
Severity: 8.2 High
Published: Apr 22, 2026
Updated: Jul 14, 2026
Reserved: Apr 20, 2026

Description

OwnTone Server versions 28.4 through 29.0 contain a race condition vulnerability in the DAAP login handler that allows unauthenticated attackers to crash the server by exploiting unsynchronized access to the global DAAP session list. Attackers can flood the DAAP /login endpoint with concurrent requests to trigger a remote denial of service condition without requiring authentication.

Scores

CVSS	Score	Vector	Source
4.0	8.2 High	CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N	VulnCheck

Weaknesses

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Affected Products

Product	Versions
owntone-serverowntone	28.4.0 to before 29.1.0Affected dca94641a5ed66500822dd51281774794cdb6c22Not affected

References

https://github.com/owntone/owntone-server/pull/1980issue-tracking
https://github.com/owntone/owntone-server/commit/dca94641a5ed66500822dd51281774794cdb6c22patch
https://www.vulncheck.com/advisories/owntone-server-race-condition-dos-via-daap-loginthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.