A critical Denial of Service vulnerability in the OwnTone media server allows remote, unauthenticated attackers to crash the service by triggering a NULL pointer dereference.

The flaw exists in the daap_reply_groups function within src/httpd_daap.c, where improper handling of input allows an unauthenticated remote attacker to cause a crash of the service.

Successful exploitation of this vulnerability results in a complete Denial of Service for the OwnTone media server. Given the CVSS score of 7.5, this high severity vulnerability poses a significant risk to service availability for users relying on the media server, potentially disrupting media streaming operations and requiring manual intervention to restore service functionality.

Immediate Action: Update the OwnTone server to a version incorporating the fix provided in commit d857116e4143a500d6a1ea13f4baa057ba3b0028.

Proactive Monitoring: Monitor system logs for repeated service crashes or unexpected restarts of the owntone-server process.

Compensating Controls: Restrict network access to the DAAP service port to trusted IP addresses using a firewall to limit exposure to potential attackers.

Public Exploit Available: No

This vulnerability presents a clear risk to the stability of the OwnTone server environment. Administrators should verify their current build and apply the upstream patch immediately to prevent potential service disruption by remote, unauthenticated actors.