A NULL pointer dereference in the parse_meta function (src/httpd_daap.c) of owntone-server commit 334beb allows attackers to cause a Denial of Service (DoS) via sending a crafted DAAP request to the server.
References
| Link | Resource |
|---|---|
| https://github.com/archersec/poc/tree/master/owntone-server | Patch Third Party Advisory |
| https://github.com/archersec/security-advisories/blob/master/owntone-server/owntone-server-advisory-2025.md | Patch Third Party Advisory |
| https://github.com/owntone/owntone-server/commit/53ee9a3c3921e5448f502800c4dfa787865f6cb7 | Patch |
Configurations
History
13 Feb 2026, 21:25
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Owntone owntone Server
Owntone |
|
| CPE | cpe:2.3:a:owntone:owntone_server:*:*:*:*:*:*:*:* |
30 Jan 2026, 20:24
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:owntone_project:owntone:*:*:*:*:*:*:*:* | |
| First Time |
Owntone Project owntone
Owntone Project |
|
| References | () https://github.com/archersec/poc/tree/master/owntone-server - Patch, Third Party Advisory | |
| References | () https://github.com/archersec/security-advisories/blob/master/owntone-server/owntone-server-advisory-2025.md - Patch, Third Party Advisory | |
| References | () https://github.com/owntone/owntone-server/commit/53ee9a3c3921e5448f502800c4dfa787865f6cb7 - Patch |
21 Jan 2026, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-476 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
20 Jan 2026, 21:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-01-20 21:16
Updated : 2026-02-13 21:25
NVD link : CVE-2025-63647
Mitre link : CVE-2025-63647
CVE.ORG link : CVE-2025-63647
JSON object : View
Products Affected
owntone
- owntone_server
CWE
CWE-476
NULL Pointer Dereference