CVE-2025-57156
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2026-01-20

Last updated on: 2026-02-13

Assigner: MITRE

Description
NULL pointer dereference in the dacp_reply_playqueueedit_clear function in src/httpd_dacp.c in owntone-server through commit 6d604a1 (newer commit after version 28.12) allows remote attackers to cause a Denial of Service (crash).
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-01-20
Last Modified
2026-02-13
Generated
2026-06-16
AI Q&A
2026-01-20
EPSS Evaluated
2026-06-15
NVD
CVE-2025-57156
EUVD
EUVD-2026-3337
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
owntone owntone_server From 28.12 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a NULL pointer dereference in the dacp_reply_playqueueedit_clear function of the Owntone server. It occurs when the 'mode' parameter is missing from an HTTP request query, causing the code to call strcmp on a null pointer. This leads to a crash or Denial of Service. The issue was fixed by adding a null check before calling strcmp to ensure the 'mode' parameter exists. [1]

Impact Analysis

This vulnerability allows remote attackers to cause a Denial of Service (crash) of the Owntone server by sending a specially crafted HTTP request missing the 'mode' parameter, which triggers a null pointer dereference. [1]

Detection Guidance

This vulnerability can be detected by monitoring for HTTP requests to the Owntone server that invoke the dacp_reply_playqueueedit_clear function without including the "mode" parameter in the query string. Specifically, sending crafted HTTP requests missing the "mode" parameter to the affected endpoint may cause the server to crash, indicating the presence of the vulnerability. There are no specific commands provided, but testing with tools like curl or custom scripts to send such requests and observing server stability can help detect it. [1]

Mitigation Strategies

The immediate mitigation step is to apply the patch that adds a null check for the "mode" parameter before performing the string comparison in the dacp_reply_playqueueedit_clear function. This patch prevents the null pointer dereference and subsequent crash. Until the patch is applied, restricting access to the Owntone server or disabling the affected functionality may reduce exposure. [1]

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-57156. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart