CVE-2026-26829: OwnTone Server DoS Vulnerability

CVE-2026-26829 Overview

A NULL pointer dereference vulnerability exists in the safe_atou64 function (src/misc.c) of owntone-server through commit c4d57aa. This vulnerability allows remote attackers to cause a Denial of Service (DoS) condition by sending a series of crafted HTTP requests to the server. The flaw occurs when the integer conversion functions fail to properly validate NULL input before processing, leading to application crashes when malformed requests are received.

Critical Impact

Remote attackers can exploit this vulnerability to crash the OwnTone media server, disrupting media streaming services for all connected clients without requiring authentication.

Affected Products

• owntone-server (versions through commit c4d57aa)

Discovery Timeline

• 2026-03-23 - CVE CVE-2026-26829 published to NVD
• 2026-03-24 - Last updated in NVD database

Technical Details for CVE-2026-26829

Vulnerability Analysis

This vulnerability is classified under CWE-476 (NULL Pointer Dereference). The root issue lies in the safe_atou64 and related integer conversion functions within src/misc.c that do not validate whether the input string pointer is NULL before attempting to process it. When a crafted HTTP request delivers NULL or missing values to these functions, the server attempts to dereference the NULL pointer, causing an immediate crash.

The attack can be executed remotely over the network without any authentication or user interaction. The vulnerability specifically affects the availability of the service while not impacting confidentiality or integrity of the data.

Root Cause

The integer conversion functions (safe_atoi32, safe_atou32, safe_atou64) in src/misc.c did not include NULL pointer checks before processing input strings. When HTTP request parameters resulted in NULL string values being passed to these functions, the code would directly call strtol() or similar functions with a NULL pointer, triggering undefined behavior and a crash.

Attack Vector

Attackers can exploit this vulnerability by sending specially crafted HTTP requests to the OwnTone server. The attack vector is network-based and requires no authentication or privileges. By manipulating HTTP request parameters to produce NULL values in specific contexts, an attacker can trigger the vulnerable code path in the integer parsing functions, causing the server to crash and denying service to legitimate users.

// Security patch in src/misc.c - NULL input validation
// Source: https://github.com/owntone/owntone-server/commit/41e3733cccd527918a08cf05694c5493341bb70f
   char *end;
   long intval;
 
-  *val = 0;
+  if (str == NULL)
+    {
+      DPRINTF(E_SPAM, L_MISC, "Input to safe_atoi32 is NULL\n");
+      return -1;
+    }
 
   errno = 0;
   intval = strtol(str, &end, 10);

// Security patch in src/db.c - Return value handling
// Source: https://github.com/owntone/owntone-server/commit/41e3733cccd527918a08cf05694c5493341bb70f
 {
   char *srcstr;
   uint32_t srcu32val;
+  int ret;
 
   if (parse_integers)
     {
       srcstr = *(char **)(src);
-      safe_atou32(srcstr, &srcu32val);
+      ret = safe_atou32(srcstr, &srcu32val);
+      if (ret < 0)
+	srcu32val = 0;
     }
   else
     srcu32val = *(uint32_t *)(src);

Detection Methods for CVE-2026-26829

Indicators of Compromise

• Unexpected OwnTone server crashes or service restarts
• Repeated HTTP requests with malformed or missing parameters targeting integer parsing endpoints
• Log entries showing NULL pointer dereference errors or segmentation faults in src/misc.c
• Unusual patterns of HTTP requests designed to trigger edge cases in parameter handling

Detection Strategies

• Monitor OwnTone server logs for crash events and segmentation fault signals
• Implement network monitoring to detect patterns of malformed HTTP requests targeting the media server
• Deploy application crash monitoring to alert on unexpected service terminations
• Use intrusion detection rules to identify repeated HTTP requests with unusual parameter patterns

Monitoring Recommendations

• Enable debug logging in OwnTone to capture detailed error messages before crash events
• Configure process monitoring to automatically restart the service and alert administrators on crashes
• Implement rate limiting on HTTP endpoints to mitigate DoS attack impact
• Monitor system logs for core dumps or crash reports associated with the OwnTone process

How to Mitigate CVE-2026-26829

Immediate Actions Required

• Update owntone-server to a version containing commit 41e3733cccd527918a08cf05694c5493341bb70f or later
• Restrict network access to the OwnTone server to trusted networks only
• Implement a reverse proxy with request validation to filter malformed HTTP requests
• Enable automatic service restart to minimize downtime in case of exploitation

Patch Information

The vulnerability has been addressed in commit 41e3733cccd527918a08cf05694c5493341bb70f. The fix adds NULL pointer validation to the safe_atoi32, safe_atou32, and safe_atou64 functions in src/misc.c, and updates callers in src/db.c to properly handle error return values from these functions.

For additional details, see the GitHub Commit Update, GitHub Security Advisory, and GitHub PoC Repository.

Workarounds

• Place OwnTone server behind a firewall and restrict access to trusted IP addresses only
• Deploy a web application firewall (WAF) to filter potentially malicious HTTP requests
• Run OwnTone in a containerized environment with automatic restart policies
• Implement network segmentation to isolate the media server from untrusted networks

# Configuration example - Restrict access using iptables
# Allow OwnTone access only from trusted local network
iptables -A INPUT -p tcp --dport 3689 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 3689 -j DROP