GCVE - cpe:2.3:a:owntone:owntone_server:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:owntone:owntone_server:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Owntone (`04ec9226-7a28-52e4-af97-77958b7148e7`)
Product	Owntone Server (`1e3ca1b4-b575-56d7-b87a-f3a2fc807973`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/owntone/owntone-server`	purl2cpe	2026-06-01 10:16:24.469554

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-63648`	vulnerable	2026-06-08 07:39:17.700900	Details available A NULL pointer dereference in the dacp_reply_playqueueedit_move function (src/httpd_dacp.c) of owntone-server commit b7e385f allows attackers to cause a Denial of Service (DoS) via sending a crafted DACP request to the server. Published: 2026-01-20T00:00:00.000Z Updated: 2026-01-21T14:47:18.727Z Open on db.gcve.eu Reference links https://github.com/owntone/owntone-server/issues/1933 https://github.com/owntone/owntone-server/commit/5f526c7a7e08c567a5c72421d74a79dafdd07621 https://github.com/archersec/security-advisories/blob/master/owntone-server/owntone-server-advisory-2025.md	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-63647`	vulnerable	2026-06-08 07:39:17.700345	Details available A NULL pointer dereference in the parse_meta function (src/httpd_daap.c) of owntone-server commit 334beb allows attackers to cause a Denial of Service (DoS) via sending a crafted DAAP request to the server. Published: 2026-01-20T00:00:00.000Z Updated: 2026-01-21T14:52:39.071Z Open on db.gcve.eu Reference links https://github.com/archersec/poc/tree/master/owntone-server https://github.com/owntone/owntone-server/commit/53ee9a3c3921e5448f502800c4dfa787865f6cb7 https://github.com/archersec/security-advisories/blob/master/owntone-server/owntone-server-advisory-2025.md	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-57156`	vulnerable	2026-06-08 07:33:15.807045	Details available NULL pointer dereference in the dacp_reply_playqueueedit_clear function in src/httpd_dacp.c in owntone-server through commit 6d604a1 (newer commit after version 28.12) allows remote attackers to cause a Denial of Service (crash). Published: 2026-01-20T00:00:00.000Z Updated: 2026-01-21T14:50:17.449Z Open on db.gcve.eu Reference links https://github.com/owntone/owntone-server/issues/1907 https://github.com/owntone/owntone-server/commit/5e4d40ee03ae22ab79534bb1410fa9db96c9fabd https://github.com/archersec/security-advisories/blob/master/owntone-server/owntone-server-advisory-2025.md	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-57155`	vulnerable	2026-06-08 07:33:15.806576	Details available NULL pointer dereference in the daap_reply_groups function in src/httpd_daap.c in owntone-server through commit 5e6f19a (newer commit after version 28.2) allows remote attackers to cause a Denial of Service. Published: 2026-01-20T00:00:00.000Z Updated: 2026-01-21T14:47:58.028Z Open on db.gcve.eu Reference links https://github.com/owntone/owntone-server/commit/d857116e4143a500d6a1ea13f4baa057ba3b0028 https://github.com/archersec/security-advisories/blob/master/owntone-server/owntone-server-advisory-2025.md	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-38383`	vulnerable	2026-06-08 05:32:55.992836	Details available OwnTone (aka owntone-server) through 28.1 has a use-after-free in net_bind() in misc.c. Published: 2021-08-10T17:14:47.000Z Updated: 2024-08-04T01:37:16.636Z Open on db.gcve.eu Reference links https://github.com/owntone/owntone-server/commit/246d8ae0cef27377e5dfe9ee3ad87e864d6b6266	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.