A critical NULL pointer dereference vulnerability in the OwnTone server allows unauthenticated remote attackers to crash the application, resulting in a denial of service.

This vulnerability is a NULL pointer dereference flaw in the dacp_reply_playqueueedit_clear function located in src/httpd_dacp.c. The vulnerability is exploitable by unauthenticated remote attackers, as confirmed by the CVSS attack vector (AV:N/PR:N).

The ability for an unauthenticated remote attacker to cause a denial of service poses a significant risk to service availability. Successful exploitation will crash the owntone-server, disrupting media playback and management services for all users. Given the CVSS score of 7.5, this represents a high-severity risk to business continuity that requires immediate attention to prevent operational downtime.

Immediate Action: Update your owntone-server instance to a version containing the fix implemented in commit 5e4d40ee03ae22ab79534bb1410fa9db96c9fabd.

Proactive Monitoring: Review server logs for frequent service restarts or unexpected process terminations that may indicate exploitation attempts.

Compensating Controls: Restrict access to the DACP interface using network-level controls or a firewall to ensure that only trusted clients can interact with the server.

Public Exploit Available: Unknown.

Organizations utilizing the OwnTone server should prioritize upgrading to the patched version as soon as possible to mitigate the risk of denial of service attacks. While the current impact is limited to service interruption, the ease of remote exploitation necessitates prompt patching to maintain system stability and availability.