Executive brief
OwnTone (formerly forked-daapd), a media server used for streaming music, is vulnerable to a critical security flaw. An attacker can send a specially crafted web request containing deeply nested instructions to crash the server or potentially take control of it. This could lead to a total loss of service or unauthorized access to the system hosting the media server.
Technical details
A stack-based buffer overflow exists in owntone-server (commit 2ca10d9) due to a lack of recursive depth checking in the expression parsing logic. Specifically, the `time_add` function within the `expression` parameter of an HTTP request (e.g., via `/api/search`) can be abused. By providing a heavily nested set of function calls, an attacker triggers infinite recursion, leading to a stack overflow. This can result in a Denial of Service (DoS) via application crash or potentially remote code execution (RCE). The vulnerability is reachable over the network without authentication.
Affected products
- owntone owntone-server 2ca10d9
Timeline
- 2025-03-07: disclosed: Issue reported on GitHub repository
- 2026-04-10: advisory: CVE published to NVD