{"id":"CVE-2026-41458","summary":"OwnTone Server \u003c 29.1 Race Condition DoS via DAAP Login","details":"OwnTone Server versions 28.4 through 29.0 contain a race condition vulnerability in the DAAP login handler that allows unauthenticated attackers to crash the server by exploiting unsynchronized access to the global DAAP session list. Attackers can flood the DAAP /login endpoint with concurrent requests to trigger a remote denial of service condition without requiring authentication.","modified":"2026-09-14T14:19:22.850187Z","published":"2026-04-22T01:46:28.142Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-362"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41458.json","unresolved_ranges":[{"extracted_events":[{"introduced":"28.4.0"},{"fixed":"29.1.0"}],"source":"AFFECTED_FIELD"},{"extracted_events":[{"introduced":"28.4.0"},{"fixed":"29.1.0"}],"source":"CPE_FIELD"}]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41458.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41458"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/owntone-server-race-condition-dos-via-daap-login"},{"type":"REPORT","url":"https://github.com/owntone/owntone-server/pull/1980"},{"type":"FIX","url":"https://github.com/owntone/owntone-server/commit/dca94641a5ed66500822dd51281774794cdb6c22"},{"type":"PACKAGE","url":"https://github.com/owntone/owntone-server"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/owntone/owntone-server","events":[{"introduced":"8598bdca138e10e85e4febb1345bc863f36734bb"},{"fixed":"bd5746c83ea04fde10c5337d2c2bfd7fc75049af"},{"fixed":"dca94641a5ed66500822dd51281774794cdb6c22"}],"database_specific":{"extracted_events":[{"introduced":"28.4"},{"fixed":"29.0"}],"source":["DESCRIPTION","REFERENCES"]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41458.json","vanir_signatures_modified":"2026-09-14T14:19:22Z","vanir_signatures":[{"source":"https://github.com/owntone/owntone-server/commit/dca94641a5ed66500822dd51281774794cdb6c22","target":{"function":"daap_reply_login","file":"src/httpd_daap.c"},"deprecated":false,"digest":{"function_hash":"182403510126227071303650837449566552180","length":901},"id":"CVE-2026-41458-031d1baf","signature_type":"Function","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/owntone/owntone-server/commit/dca94641a5ed66500822dd51281774794cdb6c22","target":{"file":"src/httpd_daap.c","function":"daap_deinit"},"deprecated":false,"digest":{"function_hash":"83633083499247449595766583960131334729","length":361},"id":"CVE-2026-41458-0422cb65"},{"deprecated":false,"digest":{"function_hash":"328019447933878973735504844791075291084","length":193},"id":"CVE-2026-41458-14d5bba1","signature_type":"Function","signature_version":"v1","source":"https://github.com/owntone/owntone-server/commit/dca94641a5ed66500822dd51281774794cdb6c22","target":{"file":"src/httpd_daap.c","function":"daap_reply_logout"}},{"deprecated":false,"digest":{"function_hash":"108540926791721990439782059602224398344","length":142},"id":"CVE-2026-41458-1abf5618","signature_type":"Function","signature_version":"v1","source":"https://github.com/owntone/owntone-server/commit/dca94641a5ed66500822dd51281774794cdb6c22","target":{"function":"daap_session_is_valid","file":"src/httpd_daap.c"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/owntone/owntone-server/commit/dca94641a5ed66500822dd51281774794cdb6c22","target":{"file":"src/httpd_daap.c","function":"daap_request_authorize"},"deprecated":false,"digest":{"length":1318,"function_hash":"165039902542357735661404473242270485753"},"id":"CVE-2026-41458-46f21863"},{"source":"https://github.com/owntone/owntone-server/commit/dca94641a5ed66500822dd51281774794cdb6c22","target":{"file":"src/httpd_daap.c","function":"daap_request"},"deprecated":false,"digest":{"function_hash":"90614967671073143524753128462190785440","length":1871},"id":"CVE-2026-41458-5ca7378e","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-41458-709f6c14","signature_type":"Function","signature_version":"v1","source":"https://github.com/owntone/owntone-server/commit/dca94641a5ed66500822dd51281774794cdb6c22","target":{"file":"src/httpd_daap.c","function":"daap_init"},"deprecated":false,"digest":{"function_hash":"147635539330872128826450963895089324970","length":116}},{"digest":{"length":658,"function_hash":"93621710636578145851058134301075986802"},"id":"CVE-2026-41458-8b73bd54","signature_type":"Function","signature_version":"v1","source":"https://github.com/owntone/owntone-server/commit/dca94641a5ed66500822dd51281774794cdb6c22","target":{"function":"daap_session_add","file":"src/httpd_daap.c"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/owntone/owntone-server/commit/dca94641a5ed66500822dd51281774794cdb6c22","target":{"file":"src/httpd_daap.c"},"deprecated":false,"digest":{"line_hashes":["208677264113453684177168503492116100624","184970127506814308795164356848844506361","123571027435843150375323517628299598618","180530328096737623210948537623104846189","57630143570132145541411983045964743410","135676724173904346698099319161523118393","253569244708249536836206859071928879963","152907423580313270088386500872652919235","236110726044312105889441034073261763452","300725920983165967800787145666122951898","87589904371243116407630176803124739851","337087298768595078516081047137617099437","232690129283353870541609992434752636247","89569577759055207294785169270188507193","3945129086634217924311957194371460037","181175325101325303650117211510466975932","253497869099808177104214578560027783228","84579800308314719634426434777879706393","127959581645392158428089944825429971353","4117492526041425555481866946874331202","322631080877209435384555040414581571729","223082391859033638906590098623888317109","325358862292066871669259188653971345296","288776050009682015377109629678479472726","114686131754725327484489621361432899321","221714615431956542221306946324594319625","145423875330851470864158988581833449528","180839657389356887582323800362366174983","57623573024395812741972607478564666996","192344278367990754636142854771322310062","205020771321471323354752137610513526957","177471865287985568249324293185595129429","129122842081802903170958075766945796459","167498219481931488106228880148124372468","329517953956848081283249460772503554171","240497245647999341197087288664214743800","3768555665923108035388904495438507142","7407319937002017287993493913310528376","103069727509687663050179985562612608200","229021111235678425418398856887295954050","292604990705864464471018253105157139010","98404286486087366650096891778202230518","60850793907838530126887003013357897690","191280605454978619517008975600241629634","124648863964413362002515972654370225999","179059167404528161290688973771311983826","58137271781009255566289351849329381475","221810675858333688239974420074677183680","118829005404660250430728842864457819329","3680914447413714703647987313459309364","41610073128601142299137196097363618818","97222032075368176797315452040579072063","198229082189019178394907450891186268763","39748193104830198047991978939359168402","129549391821426059390707830087747785286","56358717879605703910382606235288103681","255703842272321194253830732276462431921","130907438648707418373766765025326776312","63652120255525421951335988043671873530","213693930449265821756134860101357295883","152096469354950880546511490515762065313","58708414842808379630760170705244793420","99751628226532035671380319570176481131","53139316843246251420072266179835591287","251179636209503849857557103432608701282","117477013153028028766783921979255064651","100440159829992566413745409452901963809","80376014135095466277808976546737795825","269080516372969877737920223571878766295","230425048250774388824691770138092284443","29669237341239601659619952330026040975","81588138566815745915870304368859995827","245288199162625018829473376043277743348","28233586482630452830109628801552081637","275512601659276026831382198377748578506","183061453177110574855844492538640696713","337889715306939506058313875163006085477","132659385659052451550708806296013826852","156710745790755120434893720712578186745","118396005613848953469573739896435308973","164226509009640560085462800486710720931","276840476525385801617580449384873370308","123446050850518399089728205778896883212","238856354518088330355500764662299566095","204739855967436141843640733680636282478","69740966615630030464351314355680785472","304516824411096163306797682397219525344","152998759078962873967640510477776262279","311355916842948765827375649385791849147","133296493224340605197624390687502900007","191018285678664937787161861470497576414","165366544682146136843697139869745801882","79853059691668606873279456238733633061","213582717249034122492542390183054621221","255673023022908474228829943808735284983","37868659336174495961300082531884555381","298407222628376402180053718781355163847","168610709778408280226245678023395103027","198773518275735625481158190367974044872","203469942019724826665346895798732778475","1197325243486522686900618818707072792","132349780147484351106127900889969906463","312504192851334554807528458567995108245","292812181197193658349693533461985663317","322567362871385087949747633950967553343","120876945783959583059821277893531902807","25080697308340958167427294449196308861","302060093439019989190855008520334082640","273696076999248537161174122540955891381"],"threshold":0.9},"id":"CVE-2026-41458-c9253254"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}