Owntone Server

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:owntone:owntone-server:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorOwntone (04ec9226-7a28-52e4-af97-77958b7148e7)
ProductOwntone Server (01d02687-405b-56de-a350-8aacbe1245f1)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from gcve-enriched-dumps CVE data

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2026-41458 vulnerable 2026-06-08 08:03:15.409417 OwnTone Server < 29.1 Race Condition DoS via DAAP Login
OwnTone Server versions 28.4 through 29.0 contain a race condition vulnerability in the DAAP login handler that allows unauthenticated attackers to crash the server by exploiting unsynchronized access to the global DAAP session list. Attackers can flood the DAAP /login endpoint with concurrent requests to trigger a remote denial of service condition without requiring authentication.
Published: 2026-04-22T01:46:28.142Z
Updated: 2026-07-14T20:00:47.241Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-41457 vulnerable 2026-06-08 08:03:15.408944 OwnTone Server < 29.1 SQL Injection via query and filter Parameters
OwnTone Server versions 28.4 through 29.0 contain a SQL injection vulnerability in DAAP query and filter handling that allows attackers to inject arbitrary SQL expressions by supplying malicious values through the query= and filter= parameters for integer-mapped DAAP fields. Attackers can exploit insufficient sanitization of these parameters to bypass filters and gain unauthorized access to media library data.
Published: 2026-04-22T01:46:12.354Z
Updated: 2026-07-14T20:00:46.510Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.