{"id":"CVE-2026-26829","details":"A NULL pointer dereference in the safe_atou64 function (src/misc.c) of owntone-server through commit c4d57aa allows attackers to cause a Denial of Service (DoS) via sending a series of crafted HTTP requests to the server.","modified":"2026-07-15T16:34:28.497135Z","published":"2026-03-23T00:00:00Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26829.json","cna_assigner":"mitre"},"references":[{"type":"WEB","url":"https://github.com/archersec/poc/tree/master/owntone-server-2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26829.json"},{"type":"ADVISORY","url":"https://github.com/archersec/security-advisories/blob/master/owntone-server/owntone-server-advisory-2026.md"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26829"},{"type":"FIX","url":"https://github.com/owntone/owntone-server/commit/41e3733cccd527918a08cf05694c5493341bb70f"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/owntone/owntone-server","events":[{"introduced":"0"},{"fixed":"41e3733cccd527918a08cf05694c5493341bb70f"}],"database_specific":{"source":"REFERENCES"}}],"versions":["28.2","28.1","28.0","27.4","27.3","27.2","27.1","27.0","26.5","26.4","26.3","26.2","26.1","26.0","25.0","24.2","24.1","24.0","23.4","23.3","23.2","23.1","23.0","22.3","22.2","22.1","22.0","21.0","20.0","0.12","0.11","0.10","fork_cleanedup","mt-daapd_svn1696"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-26829.json","vanir_signatures_modified":"2026-07-15T16:34:28Z","vanir_signatures":[{"id":"CVE-2026-26829-0adccb56","signature_type":"Function","signature_version":"v1","source":"https://github.com/owntone/owntone-server/commit/41e3733cccd527918a08cf05694c5493341bb70f","target":{"file":"src/db.c","function":"struct_field_set_uint32"},"deprecated":false,"digest":{"function_hash":"48547692732965108384055062260437148257","length":273}},{"digest":{"function_hash":"100050503936798285203340915308810354603","length":634},"id":"CVE-2026-26829-184b19d9","signature_type":"Function","signature_version":"v1","source":"https://github.com/owntone/owntone-server/commit/41e3733cccd527918a08cf05694c5493341bb70f","target":{"file":"src/misc.c","function":"safe_hextou64"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/owntone/owntone-server/commit/41e3733cccd527918a08cf05694c5493341bb70f","target":{"file":"src/misc.c"},"deprecated":false,"digest":{"line_hashes":["166840419123962072324362729873263325800","19416551030912488822705592755458145531","125990442368523324577369299781674222278","247468892351247591648493758693866247322","192045629013959759721036865536634978770","35245564673745529362467803733329636574","131406125525245252278468901481484346193","223437774967911975891876482112392570811","278187699827153184836276557290104046247","203516889051917294464156398210244926234","244577040280577934496712700141439745414","327317869481101276457528124502306395373","200292600754674863749420848410566218209","240915450919968642882071371027193739869","113951369576117312351383913967141383167","61344259916465109270379162209029317582","64225730206719753874861427877588237002","248247407556727328235582246238660381057","327858251772163391674835696112827484873","163403915448434817524268854535558463830","71563333399770303549887212558626166556","192045629013959759721036865536634978770","35245564673745529362467803733329636574","131406125525245252278468901481484346193","223437774967911975891876482112392570811","278187699827153184836276557290104046247","203516889051917294464156398210244926234","244577040280577934496712700141439745414","13440281469794910546549710225551923514","328596522210073402535606796595589684275","131185649218361122929294348014415100340","27147282848411590567087988780747313250","61344259916465109270379162209029317582","164210212200050780056738765121234399522","248247407556727328235582246238660381057","327858251772163391674835696112827484873","241646665172068920242175263509022575055","17342396258928606572012259016025594400","192045629013959759721036865536634978770","35245564673745529362467803733329636574","131406125525245252278468901481484346193","223437774967911975891876482112392570811","278187699827153184836276557290104046247","203516889051917294464156398210244926234","244577040280577934496712700141439745414","13440281469794910546549710225551923514","328596522210073402535606796595589684275","131185649218361122929294348014415100340","27147282848411590567087988780747313250","61344259916465109270379162209029317582","164210212200050780056738765121234399522","129222031870104103417620184496961664867","227286453924426266496462806794606210509","23526609693878392995224549115304895282","167369757503962921703606530256007023534","192045629013959759721036865536634978770","35245564673745529362467803733329636574","131406125525245252278468901481484346193","223437774967911975891876482112392570811","278187699827153184836276557290104046247","203516889051917294464156398210244926234","244577040280577934496712700141439745414","116249908813779782559236389798615749643","301394565354781797879472256518273549018","255373911248602142017664614713951620566","189576791645349462279217539648100319034","61344259916465109270379162209029317582","27587577176024773681184125631406734567","198175292707238235924279476776742993626","265694238931315016563435782809096801983","86003173633588439458104694939922294621","153247319896118673161514508536622123359","145093589828511574699930048281013420056","61344259916465109270379162209029317582","221009985277107984627760804288890291026","198175292707238235924279476776742993626","265694238931315016563435782809096801983","296725689861643987666928665578593299578","252771257403925459164002425886351281497","192045629013959759721036865536634978770","35245564673745529362467803733329636574","131406125525245252278468901481484346193","223437774967911975891876482112392570811","278187699827153184836276557290104046247","203516889051917294464156398210244926234","244577040280577934496712700141439745414","281900887388141012172184716209907136406","5288289806421992472490681604936480584","209743026394240977623344491941664887733","145093589828511574699930048281013420056","61344259916465109270379162209029317582","221009985277107984627760804288890291026"],"threshold":0.9},"id":"CVE-2026-26829-24b477ef"},{"deprecated":false,"digest":{"function_hash":"241024191483682861499019035814883433564","length":634},"id":"CVE-2026-26829-405aeced","signature_type":"Function","signature_version":"v1","source":"https://github.com/owntone/owntone-server/commit/41e3733cccd527918a08cf05694c5493341bb70f","target":{"file":"src/misc.c","function":"safe_atou64"}},{"deprecated":false,"digest":{"function_hash":"95851962803320551764924459955188427338","length":651},"id":"CVE-2026-26829-62dd5966","signature_type":"Function","signature_version":"v1","source":"https://github.com/owntone/owntone-server/commit/41e3733cccd527918a08cf05694c5493341bb70f","target":{"file":"src/misc.c","function":"safe_atoi64"}},{"target":{"file":"src/db.c","function":"struct_field_set_int64"},"deprecated":false,"digest":{"function_hash":"48547692732965108384055062260437148257","length":273},"id":"CVE-2026-26829-6cff7c71","signature_type":"Function","signature_version":"v1","source":"https://github.com/owntone/owntone-server/commit/41e3733cccd527918a08cf05694c5493341bb70f"},{"digest":{"function_hash":"16067415421311726882316313165981330771","length":633},"id":"CVE-2026-26829-7c631784","signature_type":"Function","signature_version":"v1","source":"https://github.com/owntone/owntone-server/commit/41e3733cccd527918a08cf05694c5493341bb70f","target":{"file":"src/misc.c","function":"safe_atou32"},"deprecated":false},{"id":"CVE-2026-26829-b2e75928","signature_type":"Function","signature_version":"v1","source":"https://github.com/owntone/owntone-server/commit/41e3733cccd527918a08cf05694c5493341bb70f","target":{"file":"src/misc.c","function":"safe_atoi32"},"deprecated":false,"digest":{"function_hash":"244421502187955808138610436570336473678","length":649}},{"source":"https://github.com/owntone/owntone-server/commit/41e3733cccd527918a08cf05694c5493341bb70f","target":{"file":"src/db.c"},"deprecated":false,"digest":{"line_hashes":["81420638740831499584779683657862058789","59232273075136637522315849582997267375","100852304076292538224030302367709986025","48856650845972520622082381124058508055","88756291995977866604697268520846122460","129098502758767877157712406345435622860","183120233949866710527499261127513786735","156198281650536485488937846557844883059","219740291887219358253043314979634545272","189959292220672178003236350806354297818","66880584723988129781007558743999190547","276287117360818449888969491326341703370","310665537987991976487980809274528694916","307528094494252408474123111031369123508","299116905841180109436738091976948290482","143816195176682402835157936277638049735"],"threshold":0.9},"id":"CVE-2026-26829-eb05e6d0","signature_type":"Line","signature_version":"v1"},{"digest":{"function_hash":"101368239724920645636322871453613260510","length":633},"id":"CVE-2026-26829-feea912e","signature_type":"Function","signature_version":"v1","source":"https://github.com/owntone/owntone-server/commit/41e3733cccd527918a08cf05694c5493341bb70f","target":{"function":"safe_hextou32","file":"src/misc.c"},"deprecated":false}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}