CVE-2025-57156

Published: Jan 20, 2026

Modified: Jan 21, 2026

PUBLISHED

Description

NULL pointer dereference in the dacp_reply_playqueueedit_clear function in src/httpd_dacp.c in owntone-server through commit 6d604a1 (newer commit after version 28.12) allows remote attackers to cause a Denial of Service (crash).

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

https://github.com/owntone/owntone-server/issues/1907

https://github.com/owntone/owntone-server/commit/5e4d40ee03ae22ab79534bb1410fa9db96c9fabd

https://github.com/archersec/security-advisories/blob/master/owntone-server/owntone-server-advisory-2025.md

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now

CVE-2025-57156

Description

Affected Products

References