CVE-2026-41458

OwnTone Server versions 28.4 through 29.0 are affected by a race condition vulnerability (CVE-2026-41458) in the DAAP login handler that permits unauthenticated remote denial of service attacks. The vulnerability stems from unsynchronized access to the global DAAP session list, allowing attackers to manipulate concurrent requests without authentication credentials. The attack is straightforward to execute, requiring only flooding of the DAAP /login endpoint with concurrent requests to crash the server. The CVSS score is not yet published, but the EPSS score of 0.00312 indicates low exploit probability relative to other CVEs, and the vulnerability has not been added to the Known Exploited Vulnerabilities catalog. There is currently no evidence of active exploitation, and community attention remains limited, with the FAUCET Risk Score of 50.0/100 reflecting moderate but not critical concern.