A critical Denial of Service vulnerability in the owntone-server allows unauthenticated remote attackers to crash the service by sending a maliciously crafted DAAP request.

The vulnerability is a NULL pointer dereference occurring within the parse_meta function located in src/httpd_daap.c. An unauthenticated attacker can trigger this condition by submitting a specially crafted Digital Audio Access Protocol (DAAP) request, resulting in an immediate service crash.

Successful exploitation of this vulnerability results in a Denial of Service, rendering the affected media server unavailable to legitimate users. With a CVSS score of 7.5, this high-severity flaw poses a significant operational risk, as the lack of required authentication allows any remote attacker to disrupt critical media streaming services without prior system access.

Immediate Action: Update to the latest version of owntone-server or apply the official fix commits (a95b226fdb04654291b3328395ec9f7f52d54f53 or 53ee9a3c3921e5448f502800c4dfa787865f6cb7) provided by the vendor.

Proactive Monitoring: Monitor server logs for unexpected service restarts or frequent error messages associated with the DAAP interface, which may indicate exploitation attempts.

Compensating Controls: Restrict network access to the DAAP service port using host-based firewalls or network access control lists to ensure only trusted clients can communicate with the server.

Public Exploit Available: Yes, a published proof-of-concept exists via the researcher's technical advisory and repository linked in the CVE references.

Given the availability of a public proof-of-concept and the ease of triggering this service disruption, administrators should prioritize patching the owntone-server instance immediately. Failure to address this flaw leaves the media server exposed to trivial remote DoS attacks that can impact service availability.