CVE-2026-41458
- Source
- https://cve.org/CVERecord?id=CVE-2026-41458
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41458.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-41458
- Published
- 2026-04-22T01:46:28Z
- Modified
- 2026-09-08T08:14:08Z
- Severity
-
- 8.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- OwnTone Server < 29.1 Race Condition DoS via DAAP Login
- Details
-
OwnTone Server versions 28.4 through 29.0 contain a race condition vulnerability in the DAAP login handler that allows unauthenticated attackers to crash the server by exploiting unsynchronized access to the global DAAP session list. Attackers can flood the DAAP /login endpoint with concurrent requests to trigger a remote denial of service condition without requiring authentication.
- Database specific
{ "cna_assigner": "VulnCheck", "cwe_ids": [ "CWE-362" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41458.json", "unresolved_ranges": [ { "extracted_events": [ { "introduced": "28.4.0" }, { "fixed": "29.1.0" } ], "source": "AFFECTED_FIELD" }, { "extracted_events": [ { "introduced": "28.4.0" }, { "fixed": "29.1.0" } ], "source": "CPE_FIELD" } ] }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41458.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-41458
- https://www.vulncheck.com/advisories/owntone-server-race-condition-dos-via-daap-login
- https://github.com/owntone/owntone-server/pull/1980
- https://github.com/owntone/owntone-server/commit/dca94641a5ed66500822dd51281774794cdb6c22
- https://github.com/owntone/owntone-server
Affected packages
Git / github.com/owntone/owntone-server
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41458.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"function_hash": "182403510126227071303650837449566552180",
"length": 901
},
"id": "CVE-2026-41458-031d1baf",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/owntone/owntone-server/commit/dca94641a5ed66500822dd51281774794cdb6c22",
"target": {
"file": "src/httpd_daap.c",
"function": "daap_reply_login"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "83633083499247449595766583960131334729",
"length": 361
},
"id": "CVE-2026-41458-0422cb65",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/owntone/owntone-server/commit/dca94641a5ed66500822dd51281774794cdb6c22",
"target": {
"file": "src/httpd_daap.c",
"function": "daap_deinit"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "328019447933878973735504844791075291084",
"length": 193
},
"id": "CVE-2026-41458-14d5bba1",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/owntone/owntone-server/commit/dca94641a5ed66500822dd51281774794cdb6c22",
"target": {
"file": "src/httpd_daap.c",
"function": "daap_reply_logout"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "108540926791721990439782059602224398344",
"length": 142
},
"id": "CVE-2026-41458-1abf5618",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/owntone/owntone-server/commit/dca94641a5ed66500822dd51281774794cdb6c22",
"target": {
"file": "src/httpd_daap.c",
"function": "daap_session_is_valid"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "165039902542357735661404473242270485753",
"length": 1318
},
"id": "CVE-2026-41458-46f21863",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/owntone/owntone-server/commit/dca94641a5ed66500822dd51281774794cdb6c22",
"target": {
"file": "src/httpd_daap.c",
"function": "daap_request_authorize"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "90614967671073143524753128462190785440",
"length": 1871
},
"id": "CVE-2026-41458-5ca7378e",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/owntone/owntone-server/commit/dca94641a5ed66500822dd51281774794cdb6c22",
"target": {
"file": "src/httpd_daap.c",
"function": "daap_request"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "147635539330872128826450963895089324970",
"length": 116
},
"id": "CVE-2026-41458-709f6c14",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/owntone/owntone-server/commit/dca94641a5ed66500822dd51281774794cdb6c22",
"target": {
"file": "src/httpd_daap.c",
"function": "daap_init"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "93621710636578145851058134301075986802",
"length": 658
},
"id": "CVE-2026-41458-8b73bd54",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/owntone/owntone-server/commit/dca94641a5ed66500822dd51281774794cdb6c22",
"target": {
"file": "src/httpd_daap.c",
"function": "daap_session_add"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"208677264113453684177168503492116100624",
"184970127506814308795164356848844506361",
"123571027435843150375323517628299598618",
"180530328096737623210948537623104846189",
"57630143570132145541411983045964743410",
"135676724173904346698099319161523118393",
"253569244708249536836206859071928879963",
"152907423580313270088386500872652919235",
"236110726044312105889441034073261763452",
"300725920983165967800787145666122951898",
"87589904371243116407630176803124739851",
"337087298768595078516081047137617099437",
"232690129283353870541609992434752636247",
"89569577759055207294785169270188507193",
"3945129086634217924311957194371460037",
"181175325101325303650117211510466975932",
"253497869099808177104214578560027783228",
"84579800308314719634426434777879706393",
"127959581645392158428089944825429971353",
"4117492526041425555481866946874331202",
"322631080877209435384555040414581571729",
"223082391859033638906590098623888317109",
"325358862292066871669259188653971345296",
"288776050009682015377109629678479472726",
"114686131754725327484489621361432899321",
"221714615431956542221306946324594319625",
"145423875330851470864158988581833449528",
"180839657389356887582323800362366174983",
"57623573024395812741972607478564666996",
"192344278367990754636142854771322310062",
"205020771321471323354752137610513526957",
"177471865287985568249324293185595129429",
"129122842081802903170958075766945796459",
"167498219481931488106228880148124372468",
"329517953956848081283249460772503554171",
"240497245647999341197087288664214743800",
"3768555665923108035388904495438507142",
"7407319937002017287993493913310528376",
"103069727509687663050179985562612608200",
"229021111235678425418398856887295954050",
"292604990705864464471018253105157139010",
"98404286486087366650096891778202230518",
"60850793907838530126887003013357897690",
"191280605454978619517008975600241629634",
"124648863964413362002515972654370225999",
"179059167404528161290688973771311983826",
"58137271781009255566289351849329381475",
"221810675858333688239974420074677183680",
"118829005404660250430728842864457819329",
"3680914447413714703647987313459309364",
"41610073128601142299137196097363618818",
"97222032075368176797315452040579072063",
"198229082189019178394907450891186268763",
"39748193104830198047991978939359168402",
"129549391821426059390707830087747785286",
"56358717879605703910382606235288103681",
"255703842272321194253830732276462431921",
"130907438648707418373766765025326776312",
"63652120255525421951335988043671873530",
"213693930449265821756134860101357295883",
"152096469354950880546511490515762065313",
"58708414842808379630760170705244793420",
"99751628226532035671380319570176481131",
"53139316843246251420072266179835591287",
"251179636209503849857557103432608701282",
"117477013153028028766783921979255064651",
"100440159829992566413745409452901963809",
"80376014135095466277808976546737795825",
"269080516372969877737920223571878766295",
"230425048250774388824691770138092284443",
"29669237341239601659619952330026040975",
"81588138566815745915870304368859995827",
"245288199162625018829473376043277743348",
"28233586482630452830109628801552081637",
"275512601659276026831382198377748578506",
"183061453177110574855844492538640696713",
"337889715306939506058313875163006085477",
"132659385659052451550708806296013826852",
"156710745790755120434893720712578186745",
"118396005613848953469573739896435308973",
"164226509009640560085462800486710720931",
"276840476525385801617580449384873370308",
"123446050850518399089728205778896883212",
"238856354518088330355500764662299566095",
"204739855967436141843640733680636282478",
"69740966615630030464351314355680785472",
"304516824411096163306797682397219525344",
"152998759078962873967640510477776262279",
"311355916842948765827375649385791849147",
"133296493224340605197624390687502900007",
"191018285678664937787161861470497576414",
"165366544682146136843697139869745801882",
"79853059691668606873279456238733633061",
"213582717249034122492542390183054621221",
"255673023022908474228829943808735284983",
"37868659336174495961300082531884555381",
"298407222628376402180053718781355163847",
"168610709778408280226245678023395103027",
"198773518275735625481158190367974044872",
"203469942019724826665346895798732778475",
"1197325243486522686900618818707072792",
"132349780147484351106127900889969906463",
"312504192851334554807528458567995108245",
"292812181197193658349693533461985663317",
"322567362871385087949747633950967553343",
"120876945783959583059821277893531902807",
"25080697308340958167427294449196308861",
"302060093439019989190855008520334082640",
"273696076999248537161174122540955891381"
],
"threshold": 0.9
},
"id": "CVE-2026-41458-c9253254",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/owntone/owntone-server/commit/dca94641a5ed66500822dd51281774794cdb6c22",
"target": {
"file": "src/httpd_daap.c"
}
}
]
vanir_signatures_modified
"2026-09-08T08:14:08Z"