CVE-2026-41458 OwnTone Server < 29.1 Race Condition DoS via DAAP Login
Unauthenticated attackers can crash the OwnTone server by flooding the DAAP login endpoint, causing a remote denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-41458?
CVE-2026-41458 is a high-severity vulnerability in owntone-server, published on 22 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OwnTone Server versions 28.4 through 29.0 contain a race condition vulnerability in the DAAP login handler that allows unauthenticated attackers to crash the server by exploiting unsynchronized access to the global DAAP session list. Attackers can flood the DAAP /login endpoint with concurrent requests to trigger a remote denial of service condition without requiring authentication.
Weakness: CWE-362
Which versions are affected by CVE-2026-41458?
How do I fix CVE-2026-41458?
Upgrade to a fixed version.
Is CVE-2026-41458 being exploited?
There is no known exploitation of CVE-2026-41458 in the wild and no public exploit code.
Sources
Also known as GHSA-rvqf-8mp6-8qjg.