OwnTone Server CVE-2026-41458

Exploitation requires OwnTone Server versions 28.4 through 29.0 with the DAAP service exposed and listening for connections (default port 3689). No special server-side configuration, authentication, or enabled features are required - the vulnerability exists in default installations. Attack success depends on the attacker's ability to generate precisely-timed concurrent requests that overlap during the vulnerable session list manipulation window, which varies based on server hardware performance and existing load. Network latency and request batching capabilities affect exploitation reliability. Limiting factor is the high attack complexity: successful exploitation is probabilistic rather than deterministic, typically requiring multiple flooding attempts (10-50 concurrent requests) to reliably trigger the race condition. Single sequential requests or low-concurrency attempts will not trigger the crash.

Real-world risk is moderate despite the 8.2 CVSS score. The high attack complexity (AC:H) indicates exploitation requires precise timing and concurrent request orchestration, reducing reliability compared to simpler DoS vectors. Network attack vector (AV:N) and no authentication requirement (PR:N) lower the barrier, but the impact is limited to availability (VA:H) with no confidentiality or integrity effects. EPSS data not provided, and no CISA KEV listing indicates this is not confirmed as actively exploited in the wild. Public exploit code status unknown, though the GitHub commit dca94641 provides a detailed code-level fix that could enable reverse-engineering of the race condition. SSVC prioritization would likely classify this as 'scheduled' rather than 'immediate' - the attack is not automatable at scale due to timing requirements, and the technical impact (DoS only) is lower severity than RCE. Primary risk is to internet-facing OwnTone deployments where service availability is critical; internal/home media servers face minimal real threat given the attack complexity and lack of cascading effects.

An unauthenticated attacker identifies an internet-exposed OwnTone Server on port 3689 (default DAAP port) through Shodan or similar scanning. Using a custom script or tool like Apache Bench, the attacker sends 100+ concurrent HTTP requests to http://target:3689/login with minimal timing jitter to maximize race window collision probability. The unsynchronized session list modifications corrupt internal data structures, triggering a segmentation fault or assertion failure that crashes the OwnTone daemon. Legitimate users lose access to their music library until manual service restart. No public proof-of-concept identified, but the GitHub patch diff reveals the exact vulnerable code path enabling exploit development.