A critical Denial of Service vulnerability in the owntone-server allows unauthenticated remote attackers to crash the service by sending a malicious DACP request.

This vulnerability is a NULL pointer dereference occurring within the dacp_reply_playqueueedit_move function. It is exploitable by an unauthenticated attacker over the network, as indicated by the CVSS vector AV:N/AC:L/PR:N.

The successful exploitation of this vulnerability results in a Denial of Service, which effectively halts the availability of the affected server. Given the CVSS score of 7.5, this high-severity flaw poses a significant operational risk to organizations relying on this software for media streaming or service management, potentially leading to unplanned downtime and service disruption.

Immediate Action: Update to the latest version of owntone-server that includes the fix provided in commit 5f526c7a7e08c567a5c72421d74a79dafdd07621.

Proactive Monitoring: Monitor server logs and service status for unexpected crashes or service interruptions that correlate with DACP request traffic.

Compensating Controls: Implement network-level access controls to restrict access to the DACP service port to trusted IP addresses only, thereby reducing the attack surface.

Public Exploit Available: No (exploit_available: unknown)

The vulnerability represents a clear risk to service availability and should be prioritized for remediation. Administrators should verify their current version against the vendor advisory and apply the necessary updates as soon as they become available to prevent potential service outages caused by malicious actors.