Is CVE-2026-41458 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-41458 being exploited in the wild.

How severe is CVE-2026-41458?

Informational severity, with a CVSS score of 8.2, published 22 April 2026.

Which products and versions are affected?

OwnTone Server 28.4 through 29.0.

Is there a fix for CVE-2026-41458?

A patch was published on 2026-03-09: Fix committed to GitHub repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-41458 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-41458?

Check whether you run OwnTone Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-41458: OwnTone Server race condition in DAAP login handler

CVE-2026-41458 · Severity: info · CVSS 8.2 · Published 2026-04-22

OwnTone Server, a popular open-source media server, is vulnerable to a flaw that allows unauthenticated users to crash the service. By sending many simultaneous login requests, an attacker can trigger a software error that forces the server to shut down. This results in a denial of service, preventing legitimate users from accessing their music and media libraries.

Technologies: OwnTone Server. Vendors: OwnTone.

Quick answers

Is CVE-2026-41458 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-41458 being exploited in the wild.
How severe is CVE-2026-41458?: Informational severity, with a CVSS score of 8.2, published 22 April 2026.
Which products and versions are affected?: OwnTone Server 28.4 through 29.0.
Is there a fix for CVE-2026-41458?: A patch was published on 2026-03-09: Fix committed to GitHub repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41458 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-41458?: Check whether you run OwnTone Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A race condition (CWE-362) exists in the DAAP login handler of OwnTone Server due to unsynchronized access to the global DAAP session list. The vulnerability is located in the session tracking logic where concurrent access to the `daap_sessions` structure is not properly serialized. An unauthenticated remote attacker can exploit this by flooding the `/login` endpoint with simultaneous requests, leading to a null pointer dereference or memory corruption that crashes the process. The issue was addressed in version 29.1 by implementing a mutex (`daap_session_lck`) to serialize access and switching to session-ID based validation.

Affected products

OwnTone OwnTone Server 28.4 through 29.0

Timeline

2026-03-09: patched: Fix committed to GitHub repository
2026-04-21: disclosed: Vulnerability details published by VulnCheck
2026-04-22: advisory: CVE-2026-41458 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.