A critical vulnerability in the OwnTone server allows unauthenticated attackers to trigger a Denial of Service attack by sending specifically crafted HTTP requests.

This vulnerability is a NULL pointer dereference flaw located in the safe_atou64 function within the src/misc.c source file. The issue is exploitable by unauthenticated remote attackers who can trigger the crash by sending a series of malformed HTTP requests to the server.

The successful exploitation of this vulnerability results in a Denial of Service, causing the OwnTone server to crash and become unavailable to legitimate users. With a CVSS score of 7.5, the vulnerability is classified as High severity, primarily due to the ease of exploitation over the network without requiring any user interaction or prior authentication. This poses a significant risk to operational continuity for environments relying on OwnTone services.

Immediate Action: Update the owntone-server software to a version incorporating the upstream fix provided in commit 41e3733cccd527918a08cf05694c5493341bb70f.

Proactive Monitoring: Monitor server logs for repeated HTTP 500 error patterns or unexpected service termination events that may indicate an attempt to trigger the NULL pointer dereference.

Compensating Controls: Deploy a Web Application Firewall or similar network filtering solution to inspect incoming HTTP requests and block traffic containing malformed or unexpected data structures.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the security advisory by the researchers at ArcherSec.

Given the availability of a public proof-of-concept and the ease of exploitation, organizations should prioritize patching the owntone-server component immediately. Applying the vendor-provided fix is the only definitive way to resolve the underlying NULL pointer dereference and prevent service disruption.