{"id":"CVE-2026-26828","aliases":["EUVD-2026-14463","GHSA-rfmm-m252-pwvm","openSUSE-SU-2026:12216-1"],"status":"published","title":"A NULL pointer dereference in the daap_reply_playlists function (src/httpd_daap.c) of owntone...","description":"A NULL pointer dereference in the daap_reply_playlists function (src/httpd_daap.c) of owntone-server commit 3d1652d allows attackers to cause a Denial of Service (DoS) via sending a crafted DAAP request to the server","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.0036,"percentile":0.3006,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-476"],"published":"2026-03-23T00:00:00Z","modified":"2026-10-28T11:09:57Z","affected":[{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"owntone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"29.3-1.1"}]}],"bundled":3}],"references":[{"url":"https://github.com/owntone/owntone-server/issues/1961","tags":["report"]},{"url":"https://github.com/owntone/owntone-server/commit/9ac54f0b42491c4862791db4c5368ff80c4000d3","tags":["fix"]},{"url":"https://github.com/archersec/security-advisories/blob/master/owntone-server/owntone-server-advisory-2026.md","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26828","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-rfmm-m252-pwvm"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26828.json","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26828","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41457","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41458","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-26828","description":"A NULL pointer dereference in the daap_reply_playlists function (src/httpd_daap.c) of owntone-server commit 3d1652d allows attackers to cause a Denial of Service (DoS) via sending a crafted DAAP request to the server","status":"published","published":"2026-03-23T00:00:00Z","modified":"2026-03-23T16:57:05.556Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T13:38:20.971157Z"}],"euvd":[{"id":"EUVD-2026-14463","description":"A NULL pointer dereference in the daap_reply_playlists function (src/httpd_daap.c) of owntone-server commit 3d1652d allows attackers to cause a Denial of Service (DoS) via sending a crafted DAAP request to the server","status":"published","published":"2026-03-23T00:00:00Z","modified":"2026-03-23T16:57:05Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T19:25:30.696372Z"}],"ghsa":[{"id":"GHSA-rfmm-m252-pwvm","title":"A NULL pointer dereference in the daap_reply_playlists function (src/httpd_daap.c) of owntone...","description":"A NULL pointer dereference in the daap_reply_playlists function (src/httpd_daap.c) of owntone-server commit 3d1652d allows attackers to cause a Denial of Service (DoS) via sending a crafted DAAP request to the server","status":"published","published":"2026-03-23T18:30:31Z","modified":"2026-03-23T18:30:34Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T15:06:48.355489Z"}],"nvd":[{"id":"CVE-2026-26828","description":"A NULL pointer dereference in the daap_reply_playlists function (src/httpd_daap.c) of owntone-server commit 3d1652d allows attackers to cause a Denial of Service (DoS) via sending a crafted DAAP request to the server","status":"published","published":"2026-03-23T17:16:47.863Z","modified":"2026-06-17T10:26:21.09Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:12:10.568062Z"}],"osv":[{"id":"CVE-2026-26828","description":"A NULL pointer dereference in the daap_reply_playlists function (src/httpd_daap.c) of owntone-server commit 3d1652d allows attackers to cause a Denial of Service (DoS) via sending a crafted DAAP request to the server","status":"published","published":"2026-03-23T00:00:00Z","modified":"2026-10-28T11:09:57.538280067Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:59.80315Z"},{"id":"openSUSE-SU-2026:12216-1","title":"owntone-29.3-1.1 on GA media","description":"These are all security issues fixed in the owntone-29.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-21T00:00:00Z","modified":"2026-10-22T17:23:11.307242376Z","updated_at":"2026-11-02T16:58:40.245664Z"}]}}