CVE-2026-41458
HighOwnTone Server versions 28.4 through 29.0 contain a race condition vulnerability in the DAAP login handler that allows unauthenticated attackers to crash the server by exploiting unsynchronized access to the global DAAP session list.
Published Apr 21, 2026 · Updated Sep 22, 2026 · Also known as EUVD-2026-24587, GHSA-rvqf-8mp6-8qjg
Key Facts
Patch in the next maintenance window- CVE-2026-41458 is a high-severity vulnerability (CVSS 8.2 v4) affecting owntone-server.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 0.5% probability of exploitation in the next 30 days.
- Fixed versions are available, including owntone-server 29.1.0.
- Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.
CVSS v4
8.2
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS (30-day exploit likelihood)
0.5%
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2026-41458 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
OwnTone Server versions 28.4 through 29.0 contain a race condition vulnerability in the DAAP login handler that allows unauthenticated attackers to crash the server by exploiting unsynchronized access to the global DAAP session list. Attackers can flood the DAAP /login endpoint with concurrent requests to trigger a remote denial of service condition without requiring authentication.
Affected Products
1 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| owntone-server | >= 28.4.0 | 29.1.0 |
Patched Releases
owntone-server
29.1.0
Timeline
Publicly disclosed
Apr 21, 2026
Last updated
Sep 22, 2026
Weakness Type
- CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
References
- advisoryhttps://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41458.json
- advisoryhttps://github.com/owntone/owntone-server/commit/dca94641a5ed66500822dd51281774794cdb6c22
- advisoryhttps://github.com/owntone/owntone-server/pull/1980
- advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2026-41458
- advisoryhttps://www.vulncheck.com/advisories/owntone-server-race-condition-dos-via-daap-login
FAQ
Common Questions.
OwnTone Server versions 28.4 through 29.0 contain a race condition vulnerability in the DAAP login handler that allows unauthenticated attackers to crash the server by exploiting unsynchronized access to the global DAAP session list.
Affected: owntone-server versions >= 28.4.0. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including owntone-server 29.1.0.
Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.
Is CVE-2026-41458 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo