CVE-2025-57156: OwnTone Server DoS Vulnerability

CVE-2025-57156 Overview

CVE-2025-57156 is a NULL pointer dereference vulnerability in the dacp_reply_playqueueedit_clear function within src/httpd_dacp.c in owntone-server through commit 6d604a1 (newer than version 28.12). This vulnerability allows remote attackers to cause a Denial of Service (DoS) by crashing the server through specially crafted network requests.

Critical Impact

Remote attackers can crash OwnTone server instances without authentication, causing service disruption for all connected DAAP/DACP clients including iTunes Remote and other music streaming applications.

Affected Products

• OwnTone Server through commit 6d604a1 (versions newer than 28.12)
• OwnTone Server installations using DACP protocol functionality
• Systems running unpatched OwnTone server with network exposure

Discovery Timeline

• 2026-01-20 - CVE-2025-57156 published to NVD
• 2026-01-21 - Last updated in NVD database

Technical Details for CVE-2025-57156

Vulnerability Analysis

This vulnerability is classified as CWE-476 (NULL Pointer Dereference). The flaw exists in the HTTP DACP request handler responsible for processing play queue edit operations. When a remote client sends a request to clear the play queue without including the required mode parameter, the server retrieves a NULL value from the query string parsing function. The code then immediately passes this NULL pointer to strcmp() without validation, causing the server process to crash.

The vulnerability is exploitable over the network without any authentication requirements or user interaction. An attacker can trigger the crash by sending a malformed HTTP request to the DACP endpoint, resulting in complete service unavailability until the server is manually restarted.

Root Cause

The root cause is the absence of NULL pointer validation after calling httpd_query_value_find(). In the original vulnerable code, the function retrieves the mode parameter from the HTTP query string and directly uses the returned value in a strcmp() call. When the mode parameter is missing from the request, httpd_query_value_find() returns NULL, and passing NULL to strcmp() causes an immediate segmentation fault.

Attack Vector

The attack can be executed remotely over the network. An attacker needs network access to the OwnTone server's HTTP interface (typically port 3689). By sending an HTTP request to the play queue edit endpoint without the mode parameter, the attacker triggers the NULL pointer dereference. No authentication is required, and the attack has low complexity—a single malformed request is sufficient to crash the service.

   const char *param;
   struct player_status status;
 
-  param = httpd_query_value_find(hreq->query, "mode");
-
   /*
    * The mode parameter contains the playlist to be cleared.
    * If mode=0x68697374 (hex representation of the ascii string "hist") clear the history,
    * otherwise the current playlist.
    */
-  if (strcmp(param,"0x68697374") == 0)
-    player_queue_clear_history();
+  param = httpd_query_value_find(hreq->query, "mode");
+  if (param && strcmp(param,"0x68697374") == 0)
+    {
+      player_queue_clear_history();
+    }
   else
     {
       player_get_status(&status);

Source: GitHub Commit

Detection Methods for CVE-2025-57156

Indicators of Compromise

• Unexpected OwnTone server crashes or service restarts
• Segmentation fault entries in system logs associated with the owntone-server process
• HTTP requests to DACP endpoints missing required mode parameters in access logs
• Increased frequency of service availability alerts for OwnTone instances

Detection Strategies

• Monitor OwnTone server process stability and implement automatic crash detection
• Analyze HTTP access logs for requests to /ctrl-int/*/playqueue-edit endpoints lacking the mode parameter
• Deploy network intrusion detection rules to identify malformed DACP requests
• Implement application-level logging to capture HTTP parameter parsing failures

Monitoring Recommendations

• Configure process monitoring to alert on OwnTone server crashes and unexpected restarts
• Enable verbose logging in OwnTone to capture incoming DACP request details
• Set up network traffic analysis for anomalous patterns targeting port 3689
• Use SentinelOne Singularity Platform to monitor for process termination events and potential DoS attack patterns

How to Mitigate CVE-2025-57156

Immediate Actions Required

• Update OwnTone server to a version containing commit 5e4d40ee03ae22ab79534bb1410fa9db96c9fabd or later
• Restrict network access to the OwnTone server to trusted clients only
• Implement firewall rules to limit exposure of the DACP interface (port 3689)
• Consider placing OwnTone server behind a reverse proxy with request validation

Patch Information

The vulnerability has been addressed in commit 5e4d40ee03ae22ab79534bb1410fa9db96c9fabd. The fix adds a NULL check before calling strcmp() on the mode parameter, ensuring the function only proceeds with string comparison when a valid parameter value is present. Users should update to a version of OwnTone server that includes this commit.

For more information, refer to the GitHub Issue Discussion and the GitHub Security Advisory.

Workarounds

• Restrict network access to OwnTone server using firewall rules to allow only trusted IP addresses
• Deploy a web application firewall or reverse proxy to validate incoming DACP requests before they reach the server
• Implement automatic service restart mechanisms to minimize downtime in case of crashes
• Disable DACP functionality if not required for your deployment

# Configuration example - Restrict access to OwnTone server using iptables
# Allow only trusted local network (adjust IP range as needed)
iptables -A INPUT -p tcp --dport 3689 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 3689 -j DROP