Owntone Server
Vendor:
First CVE: Aug 10, 2021 · Active for 4 years
7
Total CVEs
More Total CVEs than 85% of tracked products
3.5
Avg CVEs / Year
Higher CVE frequency than 84% of tracked products
7.8
Avg CVSS
Higher Avg CVSS than 70% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Owntone Server over time
Volume of CVEsAvg CVSS Base Score
First CVE
Aug 10, 2021
4 years ago
Most Recent CVE
Apr 22, 2026
97 days ago
CVE Severity & Scoring
Owntone Server7 CVEs
14%
71%
14%
All CVEs353,240 CVEs
45%
40%
11%
MediumHighCritical
Attack Vector
Local0 (0.0%)
Network7 (100.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low6 (85.7%)
High1 (14.3%)
Unknown0 (0.0%)
User Interaction
None7 (100.0%)
Unknown0 (0.0%)
Required0 (0.0%)
Privileges Required
Low0 (0.0%)
High0 (0.0%)
None7 (100.0%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (7 CVEs).
7 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2021-38383CRITICAL OwnTone (aka owntone-server) through 28.1 has a use-after-free in net_bind() in misc.c. | Aug 10, 2021 | 9.8 | 29 | NO | NO |
CVE-2026-41458HIGH OwnTone Server versions 28.4 through 29.0 contain a race condition vulnerability in the DAAP login handler that allows unauthenticated attackers to crash the server by exploiting u | Apr 22, 2026 | 8.2 | 28 | NO | NO |
CVE-2025-63648HIGH A NULL pointer dereference in the dacp_reply_playqueueedit_move function (src/httpd_dacp.c) of owntone-server commit b7e385f allows attackers to cause a Denial of Service (DoS) via | Jan 20, 2026 | 7.5 | 28 | NO | NO |
CVE-2025-63647HIGH A NULL pointer dereference in the parse_meta function (src/httpd_daap.c) of owntone-server commit 334beb allows attackers to cause a Denial of Service (DoS) via sending a crafted D | Jan 20, 2026 | 7.5 | 28 | NO | NO |
CVE-2026-41457MEDIUM OwnTone Server versions 28.4 through 29.0 contain a SQL injection vulnerability in DAAP query and filter handling that allows attackers to inject arbitrary SQL expressions by suppl | Apr 22, 2026 | 6.9 | 25 | NO | NO |
CVE-2025-57156HIGH NULL pointer dereference in the dacp_reply_playqueueedit_clear function in src/httpd_dacp.c in owntone-server through commit 6d604a1 (newer commit after version 28.12) allows remot | Jan 20, 2026 | 7.5 | 24 | NO | NO |
CVE-2025-57155HIGH NULL pointer dereference in the daap_reply_groups function in src/httpd_daap.c in owntone-server through commit 5e6f19a (newer commit after version 28.2) allows remote attackers to | Jan 20, 2026 | 7.5 | 24 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (7 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (7 CVEs).
Media Mentions
Signals from CVEs in this product scope (7 CVEs).
Top CNAs Publishing CVEs For Owntone Server
Top CWEs
Versions
No cataloged versions.