What is the CVSS score of CVE-2026-25579?

CVE-2026-25579 has a contested CVSS base score of 6.5 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Which versions of Navidrome are affected by CVE-2026-25579?

Organizations using Navidrome should be aware of notable risk from CVE-2026-25579, a resource exhaustion vulnerability rated CVSS 6.5. Service availability could be impacted.. A patch is available.

Is there a public PoC exploit available for CVE-2026-25579?

Yes, a public proof-of-concept exploit is available for CVE-2026-25579. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-25579?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Navidrome CVE-2026-25579

MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-02-04 security-advisories@github.com

GHSA-hrr4-3wgr-68x3

Denial Of Service Linux Navidrome Suse

Medium

Disputed · 6.5 NVD

Severity by source

Sources disagree (Medium–Critical)

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SUSE

9.2 CRITICAL

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Feb 18, 2026 - 19:01 vuln.today

Public exploit code

CVE Published

Feb 04, 2026 - 22:16 nvd

MEDIUM 6.5

DescriptionGitHub Advisory

Navidrome is an open source web-based music collection server and streamer. Prior to version 0.60.0, authenticated users can crash the Navidrome server by supplying an excessively large size parameter to /rest/getCoverArt or to a shared-image URL (/share/img/<token>). When processing such requests, the server attempts to create an extremely large resized image, causing uncontrolled memory growth. This triggers the Linux OOM killer, terminates the Navidrome process, and results in a full service outage. If the system has sufficient memory and survives the allocation, Navidrome then writes these extremely large resized images into its cache directory, allowing an attacker to rapidly exhaust server disk space as well. This issue has been patched in version 0.60.0.

AnalysisAI

Navidrome versions prior to 0.60.0 allow authenticated users to trigger denial of service by requesting image resizing with extremely large parameters, causing uncontrolled memory allocation and potential disk exhaustion. Public exploit code exists for this vulnerability, which can crash the server process via the OOM killer or fill the cache directory with massive files. An attacker with valid credentials can achieve complete service outage without administrative privileges.

Technical ContextAI

Classified as CWE-400 (Uncontrolled Resource Consumption). Affects the a full component of Navidrome. Navidrome is an open source web-based music collection server and streamer. Prior to version 0.60.0, authenticated users can crash the Navidrome server by supplying an excessively large size parameter to /rest/getCoverArt or to a shared-image URL (/share/img/<token>). When processing such requests, the server attempts to create an extremely large resized image, causing uncontrolled memory growth. This triggers the Linux OOM killer, terminates the Navidrome process, and results in a full service