CVE-2026-26829

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-26829
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-26829.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-26829
Published
2026-03-23T00:00:00Z
Modified
2026-07-15T16:34:28.497135Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

A NULL pointer dereference in the safe_atou64 function (src/misc.c) of owntone-server through commit c4d57aa allows attackers to cause a Denial of Service (DoS) via sending a series of crafted HTTP requests to the server.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26829.json",
    "cna_assigner": "mitre"
}
References

Affected packages

Git / github.com/owntone/owntone-server

Affected ranges

Type
GIT
Repo
https://github.com/owntone/owntone-server
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
41e3733cccd527918a08cf05694c5493341bb70f
Database specific 
{
    "source": "REFERENCES"
}

Affected versions

0.*
0.10
0.11
0.12
20.*
20.0
21.*
21.0
22.*
22.0
22.1
22.2
22.3
23.*
23.0
23.1
23.2
23.3
23.4
24.*
24.0
24.1
24.2
25.*
25.0
26.*
26.0
26.1
26.2
26.3
26.4
26.5
27.*
27.0
27.1
27.2
27.3
27.4
28.*
28.0
28.1
28.2
Other
fork_cleanedup
mt-daapd_svn1696

Database specific

vanir_signatures 
[
    {
        "source": "https://github.com/owntone/owntone-server/commit/41e3733cccd527918a08cf05694c5493341bb70f",
        "signature_version": "v1",
        "signature_type": "Function",
        "digest": {
            "function_hash": "48547692732965108384055062260437148257",
            "length": 273.0
        },
        "deprecated": false,
        "id": "CVE-2026-26829-0adccb56",
        "target": {
            "function": "struct_field_set_uint32",
            "file": "src/db.c"
        }
    },
    {
        "source": "https://github.com/owntone/owntone-server/commit/41e3733cccd527918a08cf05694c5493341bb70f",
        "signature_version": "v1",
        "signature_type": "Function",
        "digest": {
            "function_hash": "100050503936798285203340915308810354603",
            "length": 634.0
        },
        "deprecated": false,
        "id": "CVE-2026-26829-184b19d9",
        "target": {
            "function": "safe_hextou64",
            "file": "src/misc.c"
        }
    },
    {
        "source": "https://github.com/owntone/owntone-server/commit/41e3733cccd527918a08cf05694c5493341bb70f",
        "signature_version": "v1",
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "166840419123962072324362729873263325800",
                "19416551030912488822705592755458145531",
                "125990442368523324577369299781674222278",
                "247468892351247591648493758693866247322",
                "192045629013959759721036865536634978770",
                "35245564673745529362467803733329636574",
                "131406125525245252278468901481484346193",
                "223437774967911975891876482112392570811",
                "278187699827153184836276557290104046247",
                "203516889051917294464156398210244926234",
                "244577040280577934496712700141439745414",
                "327317869481101276457528124502306395373",
                "200292600754674863749420848410566218209",
                "240915450919968642882071371027193739869",
                "113951369576117312351383913967141383167",
                "61344259916465109270379162209029317582",
                "64225730206719753874861427877588237002",
                "248247407556727328235582246238660381057",
                "327858251772163391674835696112827484873",
                "163403915448434817524268854535558463830",
                "71563333399770303549887212558626166556",
                "192045629013959759721036865536634978770",
                "35245564673745529362467803733329636574",
                "131406125525245252278468901481484346193",
                "223437774967911975891876482112392570811",
                "278187699827153184836276557290104046247",
                "203516889051917294464156398210244926234",
                "244577040280577934496712700141439745414",
                "13440281469794910546549710225551923514",
                "328596522210073402535606796595589684275",
                "131185649218361122929294348014415100340",
                "27147282848411590567087988780747313250",
                "61344259916465109270379162209029317582",
                "164210212200050780056738765121234399522",
                "248247407556727328235582246238660381057",
                "327858251772163391674835696112827484873",
                "241646665172068920242175263509022575055",
                "17342396258928606572012259016025594400",
                "192045629013959759721036865536634978770",
                "35245564673745529362467803733329636574",
                "131406125525245252278468901481484346193",
                "223437774967911975891876482112392570811",
                "278187699827153184836276557290104046247",
                "203516889051917294464156398210244926234",
                "244577040280577934496712700141439745414",
                "13440281469794910546549710225551923514",
                "328596522210073402535606796595589684275",
                "131185649218361122929294348014415100340",
                "27147282848411590567087988780747313250",
                "61344259916465109270379162209029317582",
                "164210212200050780056738765121234399522",
                "129222031870104103417620184496961664867",
                "227286453924426266496462806794606210509",
                "23526609693878392995224549115304895282",
                "167369757503962921703606530256007023534",
                "192045629013959759721036865536634978770",
                "35245564673745529362467803733329636574",
                "131406125525245252278468901481484346193",
                "223437774967911975891876482112392570811",
                "278187699827153184836276557290104046247",
                "203516889051917294464156398210244926234",
                "244577040280577934496712700141439745414",
                "116249908813779782559236389798615749643",
                "301394565354781797879472256518273549018",
                "255373911248602142017664614713951620566",
                "189576791645349462279217539648100319034",
                "61344259916465109270379162209029317582",
                "27587577176024773681184125631406734567",
                "198175292707238235924279476776742993626",
                "265694238931315016563435782809096801983",
                "86003173633588439458104694939922294621",
                "153247319896118673161514508536622123359",
                "145093589828511574699930048281013420056",
                "61344259916465109270379162209029317582",
                "221009985277107984627760804288890291026",
                "198175292707238235924279476776742993626",
                "265694238931315016563435782809096801983",
                "296725689861643987666928665578593299578",
                "252771257403925459164002425886351281497",
                "192045629013959759721036865536634978770",
                "35245564673745529362467803733329636574",
                "131406125525245252278468901481484346193",
                "223437774967911975891876482112392570811",
                "278187699827153184836276557290104046247",
                "203516889051917294464156398210244926234",
                "244577040280577934496712700141439745414",
                "281900887388141012172184716209907136406",
                "5288289806421992472490681604936480584",
                "209743026394240977623344491941664887733",
                "145093589828511574699930048281013420056",
                "61344259916465109270379162209029317582",
                "221009985277107984627760804288890291026"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "id": "CVE-2026-26829-24b477ef",
        "target": {
            "file": "src/misc.c"
        }
    },
    {
        "source": "https://github.com/owntone/owntone-server/commit/41e3733cccd527918a08cf05694c5493341bb70f",
        "signature_version": "v1",
        "signature_type": "Function",
        "digest": {
            "function_hash": "241024191483682861499019035814883433564",
            "length": 634.0
        },
        "deprecated": false,
        "id": "CVE-2026-26829-405aeced",
        "target": {
            "function": "safe_atou64",
            "file": "src/misc.c"
        }
    },
    {
        "source": "https://github.com/owntone/owntone-server/commit/41e3733cccd527918a08cf05694c5493341bb70f",
        "signature_version": "v1",
        "signature_type": "Function",
        "digest": {
            "function_hash": "95851962803320551764924459955188427338",
            "length": 651.0
        },
        "deprecated": false,
        "id": "CVE-2026-26829-62dd5966",
        "target": {
            "function": "safe_atoi64",
            "file": "src/misc.c"
        }
    },
    {
        "source": "https://github.com/owntone/owntone-server/commit/41e3733cccd527918a08cf05694c5493341bb70f",
        "signature_version": "v1",
        "signature_type": "Function",
        "digest": {
            "function_hash": "48547692732965108384055062260437148257",
            "length": 273.0
        },
        "deprecated": false,
        "id": "CVE-2026-26829-6cff7c71",
        "target": {
            "function": "struct_field_set_int64",
            "file": "src/db.c"
        }
    },
    {
        "source": "https://github.com/owntone/owntone-server/commit/41e3733cccd527918a08cf05694c5493341bb70f",
        "signature_version": "v1",
        "signature_type": "Function",
        "digest": {
            "function_hash": "16067415421311726882316313165981330771",
            "length": 633.0
        },
        "deprecated": false,
        "id": "CVE-2026-26829-7c631784",
        "target": {
            "function": "safe_atou32",
            "file": "src/misc.c"
        }
    },
    {
        "source": "https://github.com/owntone/owntone-server/commit/41e3733cccd527918a08cf05694c5493341bb70f",
        "signature_version": "v1",
        "signature_type": "Function",
        "digest": {
            "function_hash": "244421502187955808138610436570336473678",
            "length": 649.0
        },
        "deprecated": false,
        "id": "CVE-2026-26829-b2e75928",
        "target": {
            "function": "safe_atoi32",
            "file": "src/misc.c"
        }
    },
    {
        "source": "https://github.com/owntone/owntone-server/commit/41e3733cccd527918a08cf05694c5493341bb70f",
        "signature_version": "v1",
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "81420638740831499584779683657862058789",
                "59232273075136637522315849582997267375",
                "100852304076292538224030302367709986025",
                "48856650845972520622082381124058508055",
                "88756291995977866604697268520846122460",
                "129098502758767877157712406345435622860",
                "183120233949866710527499261127513786735",
                "156198281650536485488937846557844883059",
                "219740291887219358253043314979634545272",
                "189959292220672178003236350806354297818",
                "66880584723988129781007558743999190547",
                "276287117360818449888969491326341703370",
                "310665537987991976487980809274528694916",
                "307528094494252408474123111031369123508",
                "299116905841180109436738091976948290482",
                "143816195176682402835157936277638049735"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "id": "CVE-2026-26829-eb05e6d0",
        "target": {
            "file": "src/db.c"
        }
    },
    {
        "source": "https://github.com/owntone/owntone-server/commit/41e3733cccd527918a08cf05694c5493341bb70f",
        "signature_version": "v1",
        "signature_type": "Function",
        "digest": {
            "function_hash": "101368239724920645636322871453613260510",
            "length": 633.0
        },
        "deprecated": false,
        "id": "CVE-2026-26829-feea912e",
        "target": {
            "function": "safe_hextou32",
            "file": "src/misc.c"
        }
    }
]
vanir_signatures_modified 
"2026-07-15T16:34:28Z"
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-26829.json"