Vulnerability · Published Apr 22, 2026 · Assigned by VulnCheck

CVE-2026-41458OwnTone Server < 29.1 Race Condition DoS via DAAP Login

High 8.2

In plain English

A high-severity race condition in owntone-server from owntone. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).

Severity (CVSS 4.0)8.2High

Exploit odds (30 days)0.4%top 69.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

OwnTone Server versions 28.4 through 29.0 contain a race condition vulnerability in the DAAP login handler that allows unauthenticated attackers to crash the server by exploiting unsynchronized access to the global DAAP session list. Attackers can flood the DAAP /login endpoint with concurrent requests to trigger a remote denial of service condition without requiring authentication.

Affected products (as reported)

Vendor	Product	Versions
owntone	owntone-server	28.4.0 – before 29.1.0

Weakness: CWE-362 · Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

https://github.com/owntone/owntone-server/pull/1980 issue-tracking
https://github.com/owntone/owntone-server/commit/dca94641a5ed66500822dd51281774794cdb6c22 patch
https://www.vulncheck.com/advisories/owntone-server-race-condition-dos-via-daap-login third-party-advisory