CVE-2026-41458CWE-362

OwnTone Server < 29.1 Race Condition DoS via DAAP Login

High · published April 22, 2026

CVSS v4.0
8.2
EPSS
1%
Percentile
43.5
In the wild
Unconfirmed
What it is

OwnTone Server versions 28.4 through 29.0 contain a race condition vulnerability in the DAAP login handler that allows unauthenticated attackers to crash the server by exploiting unsynchronized access to the global DAAP session list. Attackers can flood the DAAP /login endpoint with concurrent requests to trigger a remote denial of service condition without requiring authentication.

The record
Technical detail
CVSS v4.0
8.2 · HIGH
Vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00523 · 43.5th percentile
Weakness
CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Published
2026-04-22T01:46Z
EPSS history
Timeline
  • 22 APR 01:46Z
    OwnTone Server < 29.1 Race Condition DoS via DAAP Login
    cvelistv5