A critical vulnerability in the owntone-server allows unauthenticated remote attackers to crash the service, resulting in a Denial of Service.

The vulnerability is a NULL pointer dereference located in the daap_reply_playlists function within the source file src/httpd_daap.c. An unauthenticated attacker can trigger this flaw by sending a specifically crafted DAAP request to the server, leading to application instability and service disruption.

The successful exploitation of this vulnerability results in a Denial of Service, which can disrupt media streaming services provided by the software. With a CVSS score of 7.5, this high-severity flaw poses a significant risk to operational continuity, as it allows any remote, unauthenticated actor to force a crash of the affected service.

Immediate Action: Review the official OwnTone GitHub repository for the fix provided in commit 9ac54f0b42491c4862791db4c5368ff80c4000d3 and apply the necessary code changes or update to a version incorporating this patch.

Proactive Monitoring: Monitor server logs for repeated or malformed DAAP request patterns that may indicate attempts to trigger the NULL pointer dereference.

Compensating Controls: Deploy network-level access controls or a firewall to restrict access to the DAAP service port to known, trusted clients only.

Public Exploit Available: Unknown

Given the high CVSS score and the ease of exploitation, system administrators must prioritize applying the upstream fix. Ensure that the owntone-server instance is updated to a commit or release that includes the patch for the daap_reply_playlists function to prevent potential service outages.