Owntone Owntone Server
5 CVEs affecting Owntone Owntone Server. Latest disclosed: 2026-01-20. Critical: 1, High: 4.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-38383 | Critical | 9.8 | 2021-08-10 | OwnTone (aka owntone-server) through 28.1 has a use-after-free in net_bind() in misc.c. |
CVE-2025-63648 | High | 7.5 | 2026-01-20 | A NULL pointer dereference in the dacp_reply_playqueueedit_move function (src/httpd_dacp.c) of owntone-server commit b7e385f allows attackers to cause a Denial… |
CVE-2025-63647 | High | 7.5 | 2026-01-20 | A NULL pointer dereference in the parse_meta function (src/httpd_daap.c) of owntone-server commit 334beb allows attackers to cause a Denial of Service (DoS) vi… |
CVE-2025-57156 | High | 7.5 | 2026-01-20 | NULL pointer dereference in the dacp_reply_playqueueedit_clear function in src/httpd_dacp.c in owntone-server through commit 6d604a1 (newer commit after versio… |
CVE-2025-57155 | High | 7.5 | 2026-01-20 | NULL pointer dereference in the daap_reply_groups function in src/httpd_daap.c in owntone-server through commit 5e6f19a (newer commit after version 28.2) allow… |