OwnTone vulnerabilities
We track 5 vulnerabilities in OwnTone products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on April 22, 2026.
Latest OwnTone vulnerabilities
- 8.2 High severity
owntone-server: Concurrent Execution using Shared Resource with Improper Synchronization
OwnTone Server versions 28.4 through 29.0 contain a race condition vulnerability in the DAAP login handler that allows unauthenticated attackers to crash the server by exploiting unsynchronized access to the global DAAP session list. Attackers can flood the DA
- 7.5 High severity
Owntone Server: NULL Pointer Dereference
A NULL pointer dereference in the dacp_reply_playqueueedit_move function (src/httpd_dacp.c) of owntone-server commit b7e385f allows attackers to cause a Denial of Service (DoS) via sending a crafted DACP request to the server.
- 7.5 High severity
Owntone Server: NULL Pointer Dereference
A NULL pointer dereference in the parse_meta function (src/httpd_daap.c) of owntone-server commit 334beb allows attackers to cause a Denial of Service (DoS) via sending a crafted DAAP request to the server.
- 7.5 High severity
Owntone Server: NULL Pointer Dereference
NULL pointer dereference in the dacp_reply_playqueueedit_clear function in src/httpd_dacp.c in owntone-server through commit 6d604a1 (newer commit after version 28.12) allows remote attackers to cause a Denial of Service (crash).
- 7.5 High severity
Owntone Server: NULL Pointer Dereference
NULL pointer dereference in the daap_reply_groups function in src/httpd_daap.c in owntone-server through commit 5e6f19a (newer commit after version 28.2) allows remote attackers to cause a Denial of Service.