CVE-2025-63648

Name of the Vulnerable Software and Affected Versions owntone-server commit b7e385f

Description A flaw exists in owntone-server that can lead to a Denial of Service (DoS). Specifically, a NULL pointer dereference is present in the dacp reply playqueueedit move function located in the src/httpd dacp.c file. This issue can be triggered by sending a specially crafted DACP request to the server.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.